Read the docs
TI-2026-36338 Aliases CVE-2026-49114GHSA-q56x-g2fj-4rj6

ONNX symlink-following and path-traversal arbitrary file write

Priority MEDIUM 63CWE-22Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

In ONNX before 1.21.0, the 'save_external_data' function builds the external-data file path from the model's external_data location field and opens it for writing without 'O_NOFOLLOW/O_EXCL', after a non-atomic 'os.path.isfile()' check. A local attacker with write access to the directory where a victim serializes external data can deterministically pre-plant a symlink that is being followed, causing the victim's write to append to any file the victim can write, e.g. ~/.ssh/authorized_keys, cron files, or application configs. Fixed in 1.21.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00159 5th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix Fixed ONNX (ONNX): 1.21.0onnx (PyPI): 1.21.0Red Hat: 2 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
onnxONNXbefore 1.21.01.21.0Patch availableCNA
—onnx (PyPI)before 1.21.01.21.0Patch availableGHSA-q56x-g2fj-4rj6
  • ONNX Vendoronnx Affected before 1.21.0 Fixed in 1.21.0 Patch available CNA
  • onnx (PyPI) Vendor— Affected before 1.21.0 Fixed in 1.21.0 Patch available GHSA-q56x-g2fj-4rj6

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:linuxfoundation:onnx:*:*:*:*:*:*:*:*before 1.21.0Vulnerablebackstage
  • cpe:2.3:a:linuxfoundation:onnx:*:*:*:*:*:*:*:* Versions before 1.21.0 Vulnerable ·backstage

Remediation

  • Fix · CNA ONNX (ONNX) Fixed in 1.21.0
  • Fix · GHSA-q56x-g2fj-4rj6 onnx (PyPI) Fixed in 1.21.0 Advisory →

Red Hat 2 advisories

  • RHSA-2026:87410 Released 2026-10-21 · Red Hat rating Critical
    RHOAI 2.25.12 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-codeflare-operator-rhel9 +47
  • RHSA-2026:84734 Released 2026-10-19 · Red Hat rating Critical
    RHOAI 3.4.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift AI 2.25Fixed RHSA-2026:87410
Red Hat OpenShift AI 3.4Fixed RHSA-2026:84734
Not affected: 3 products
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 2.25
  • Red Hat OpenShift AI 3.4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-49114
  2. 2026-10-03 Alias added: GHSA-q56x-g2fj-4rj6
  3. 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
  4. 2026-10-20 Fix available: Red Hat OpenShift AI 3.4 · Red Hat
  5. 2026-10-22 Fix available: RHSA-2026:87410 · Red Hat
  6. 2026-10-23 Fix available: Red Hat OpenShift AI 2.25 · Red Hat

References

Exploit 1

Advisory 3

Other 1

  • TI-2026-22763 ONNX Untrusted Model Repository Warnings Suppressed by silent=True in onnx.hub.load() — Silent Supply-Chain Attack CVSS 3.1CRITICAL 9.1
  • TI-2026-21896 ONNX: Path Traversal via Symlink CVSS 4.0HIGH 8.7
  • TI-2024-07209 Arbitrary File Overwrite in onnx/onnx CVSS 3.1CRITICAL 9.1
  • TI-2024-04814 Arbitrary File Overwrite in download_model_with_test_data in onnx/onnx CVSS 3.1HIGH 8.8
  • TI-2026-32442 ONNX: Null Pointer Dereference in Upsample Version Converter Adapter (Zero Inputs) CVSS 3.1MEDIUM 5.5
  • TI-2026-26712 ONNX: External Data Symlink Traversal CVSS 3.1MEDIUM 5.5
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences