TI-2026-26710 Aliases CVE-2026-34445 GHSA-538c-55jv-c5g9

ONNX: Malicious ONNX models can crash servers by exploiting unprotected object settings.

MEDIUM 43CWE-20Published 2026-04-01 · Updated 2026-04-01

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service, Tampering
Confidentiality · integrity · availability: Low · Low · High
Fix status: Partial Red Hat: 2 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400 and CWE-915.

Summary

Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, the ExternalDataInfo class in ONNX was using Python’s setattr() function to load metadata (like file paths or data lengths) directly from an ONNX model file. It didn’t check if the "keys" in the file were valid. Due to this, an attacker could craft a malicious model that overwrites internal object properties. This issue has been patched in version 1.21.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00292 21st percentileScored 2026-11-07

Fix Partial onnx (onnx): 1.21.0onnx (PyPI): 1.21.0Red Hat: 2 advisoriesRed Hat: 2 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
onnx	onnx	before 1.21.0	1.21.0	Patch available	CNA
—	onnx (PyPI)	before 1.21.0	1.21.0	Patch available	GHSA-538c-55jv-c5g9

onnx Vendoronnx Affected before 1.21.0 Fixed in 1.21.0 Patch available CNA
onnx (PyPI) Vendor— Affected before 1.21.0 Fixed in 1.21.0 Patch available GHSA-538c-55jv-c5g9

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:linuxfoundation:onnx::::::::	before 1.21.0	Vulnerable	backstage

cpe:2.3:a:linuxfoundation:onnx:*:*:*:*:*:*:*:* Versions before 1.21.0 Vulnerable ·backstage

Remediation

Fix · CNA onnx (onnx) Fixed in 1.21.0
Fix · GHSA-538c-55jv-c5g9 onnx (PyPI) Fixed in 1.21.0 Advisory →

Red Hat 2 advisories

RHSA-2026:73987 Released 2026-09-30 · Red Hat rating Critical
RHOAI 3.3.7 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +47
RHSA-2026:65126 Released 2026-09-08 · Red Hat rating Important
RHOAI 2.25.11 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat OpenShift AI (RHOAI)	Affected	No fix yet
Red Hat OpenShift AI 2.25	Fixed	RHSA-2026:65126
Red Hat OpenShift AI 3.3	Fixed	RHSA-2026:73987

Not affected: 2 products

Red Hat OpenShift AI 2.25
Red Hat OpenShift AI 3.3

Timeline

2026-10-02 Threatist record created from CVE-2026-34445
2026-10-03 Alias added: GHSA-538c-55jv-c5g9
2026-10-07 Fix available: RHSA-2026:73987 · Red Hat

References

Patch 3

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-34445

Other 1

https://github.com/onnx/onnx

TI-2026-22763 ONNX Untrusted Model Repository Warnings Suppressed by silent=True in onnx.hub.load() — Silent Supply-Chain Attack CVSS 3.1CRITICAL 9.1
TI-2026-21896 ONNX: Path Traversal via Symlink CVSS 4.0HIGH 8.7
TI-2024-07209 Arbitrary File Overwrite in onnx/onnx CVSS 3.1CRITICAL 9.1
TI-2024-04814 Arbitrary File Overwrite in download_model_with_test_data in onnx/onnx CVSS 3.1HIGH 8.8
TI-2026-36338 ONNX symlink-following and path-traversal arbitrary file write CVSS 4.0MEDIUM 6.8
TI-2026-32442 ONNX: Null Pointer Dereference in Upsample Version Converter Adapter (Zero Inputs) CVSS 3.1MEDIUM 5.5

See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences