ONNX: Path Traversal via Symlink
Priority HIGH 77CWE-23Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 2 fixed, 1 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-23 and the CVSS impact.
Summary
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, a path traversal vulnerability via symlink allows to read arbitrary files outside model or user-provided directory. This issue has been patched in version 1.21.0.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00616 49th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial onnx (onnx): 1.21.0onnx (PyPI): 1.21.0Red Hat: 2 advisoriesRed Hat: 2 fixed, 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| onnx | onnx | before 1.21.0 | 1.21.0 | Patch available | CNA |
| — | onnx (PyPI) | before 1.21.0 | 1.21.0 | Patch available | GHSA-3r9x-f23j-gc73 |
- onnx Vendoronnx Affected before 1.21.0 Fixed in 1.21.0 Patch available CNA
- onnx (PyPI) Vendor— Affected before 1.21.0 Fixed in 1.21.0 Patch available GHSA-3r9x-f23j-gc73
Remediation
- Fix · CNA onnx (onnx) Fixed in 1.21.0
- Fix · GHSA-3r9x-f23j-gc73 onnx (PyPI) Fixed in 1.21.0 Advisory →
Red Hat 2 advisories
- RHSA-2026:73987 Released 2026-09-30 · Red Hat rating CriticalRHOAI 3.3.7 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +47
- RHSA-2026:24977 Released 2026-06-10 · Red Hat rating ImportantRHOAI 2.25.7 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +34
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet |
| Red Hat OpenShift AI 2.25 | Fixed | RHSA-2026:24977 |
| Red Hat OpenShift AI 3.3 | Fixed | RHSA-2026:73987 |
Not affected: 2 products
- Red Hat OpenShift AI 2.25
- Red Hat OpenShift AI 3.3
Timeline
- 2026-10-02 Threatist record created from CVE-2026-27489
- 2026-10-03 Alias added: GHSA-3r9x-f23j-gc73
- 2026-10-07 Fix available: RHSA-2026:73987 · Red Hat
- 2026-11-04 CVSS score changed · GHSA-3r9x-f23j-gc73
- 2026-11-04 Weakness changed · GHSA-3r9x-f23j-gc73
- 2026-11-04 5 new references · GHSA-3r9x-f23j-gc73
References
Other 6
- https://access.redhat.com/errata/RHSA-2026:24977
- https://access.redhat.com/security/cve/CVE-2026-27489
- https://bugzilla.redhat.com/show_bug.cgi?id=2453929
- https://github.com/onnx/onnx
- https://github.com/pypa/advisory-database/tree/main/vulns/onnx/PYSEC-2026-2239.yaml
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27489.json
More onnx vulnerabilities
- TI-2026-22763 ONNX Untrusted Model Repository Warnings Suppressed by silent=True in onnx.hub.load() — Silent Supply-Chain Attack CVSS 3.1CRITICAL 9.1
- TI-2024-07209 Arbitrary File Overwrite in onnx/onnx CVSS 3.1CRITICAL 9.1
- TI-2024-04814 Arbitrary File Overwrite in download_model_with_test_data in onnx/onnx CVSS 3.1HIGH 8.8
- TI-2026-36338 ONNX symlink-following and path-traversal arbitrary file write CVSS 4.0MEDIUM 6.8
- TI-2026-32442 ONNX: Null Pointer Dereference in Upsample Version Converter Adapter (Zero Inputs) CVSS 3.1MEDIUM 5.5
- TI-2026-26712 ONNX: External Data Symlink Traversal CVSS 3.1MEDIUM 5.5
Sources
- CVE-2026-27489 · CVE Program
- CVE-2026-27489 · NVD
- FIRST EPSS
- GHSA-3r9x-f23j-gc73 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-27489 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences