CVE-2026-28500

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-28500", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-27T20:57:47.708Z", "datePublished": "2026-03-18T01:15:07.644Z", "dateUpdated": "2026-07-15T01:11:41.016Z"}, "containers": {"cna": {"title": "ONNX Untrusted Model Repository Warnings Suppressed by silent=True in onnx.hub.load() \u2014 Silent Supply-Chain Attack", "problemTypes": [{"descriptions": [{"cweId": "CWE-345", "lang": "en", "description": "CWE-345: Insufficient Verification of Data Authenticity", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-494", "lang": "en", "description": "CWE-494: Download of Code Without Integrity Check", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-693", "lang": "en", "description": "CWE-693: Protection Mechanism Failure", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/onnx/onnx/security/advisories/GHSA-hqmj-h5c6-369m", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/onnx/onnx/security/advisories/GHSA-hqmj-h5c6-369m"}, {"name": "https://github.com/ZeroXJacks/CVEs/blob/main/2026/CVE-2026-28500.md", "tags": ["x_refsource_MISC"], "url": "https://github.com/ZeroXJacks/CVEs/blob/main/2026/CVE-2026-28500.md"}], "affected": [{"vendor": "onnx", "product": "onnx", "versions": [{"version": "<= 1.20.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-18T01:15:07.644Z"}, "descriptions": [{"lang": "en", "value": "Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. In versions up to and including 1.20.1, a security control bypass exists in onnx.hub.load() due to improper logic in the repository trust verification mechanism. While the function is designed to warn users when loading models from non-official sources, the use of the silent=True parameter completely suppresses all security warnings and confirmation prompts. This vulnerability transforms a standard model-loading function into a vector for Zero-Interaction Supply-Chain Attacks. When chained with file-system vulnerabilities, an attacker can silently exfiltrate sensitive files (SSH keys, cloud credentials) from the victim's machine the moment the model is loaded. As of time of publication, no known patched versions are available."}], "source": {"advisory": "GHSA-hqmj-h5c6-369m", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/ZeroXJacks/CVEs/blob/main/2026/CVE-2026-28500.md", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-18T14:08:46.596652Z", "id": "CVE-2026-28500", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-18T14:08:50.003Z"}}, {"affected": [{"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:2.25::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9", "product": "Red Hat OpenShift AI 2.25", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1780078312", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:2.25::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9", "product": "Red Hat OpenShift AI 2.25", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1780078429", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:2.25::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9", "product": "Red Hat OpenShift AI 2.25", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1780069222", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:2.25::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9", "product": "Red Hat OpenShift AI 2.25", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1780078632", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:2.25::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9", "product": "Red Hat OpenShift AI 2.25", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1780078416", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:2.25::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9", "product": "Red Hat OpenShift AI 2.25", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1780417775", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:2.25::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9", "product": "Red Hat OpenShift AI 2.25", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1780078388", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:2.25::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9", "product": "Red Hat OpenShift AI 2.25", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1780069146", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:2.25::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9", "product": "Red Hat OpenShift AI 2.25", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1780078413", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:2.25::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9", "product": "Red Hat OpenShift AI 2.25", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1780069226", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:2.25::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9", "product": "Red Hat OpenShift AI 2.25", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1780078629", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:2.25::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9", "product": "Red Hat OpenShift AI 2.25", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1780078414", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:2.25::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9", "product": "Red Hat OpenShift AI 2.25", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1780078632", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:2.25::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9", "product": "Red Hat OpenShift AI 2.25", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1780069222", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "affected", "packageName": "rhoai/odh-openvino-model-server-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}], "datePublic": "2026-03-18T01:15:07.644Z", "descriptions": [{"lang": "en", "value": "A flaw was found in Open Neural Network Exchange (ONNX), an open standard for machine learning interoperability. A security control bypass exists in the `onnx.hub.load()` function due to improper logic in its repository trust verification. An attacker can exploit this by providing a malicious model, which, when loaded with the `silent=True` parameter, suppresses all security warnings. This vulnerability transforms a standard model-loading function into a vector for Zero-Interaction Supply-Chain Attacks."}], "metrics": [{"other": {"content": {"namespace": "https://access.redhat.com/security/updates/classification/", "value": "Important"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-829", "description": "Inclusion of Functionality from Untrusted Control Sphere", "lang": "en", "type": "CWE"}]}], "references": [{"tags": ["vdb-entry", "x_refsource_REDHAT"], "url": "https://access.redhat.com/security/cve/CVE-2026-28500"}, {"name": "RHBZ#2448518", "tags": ["issue-tracking", "x_refsource_REDHAT"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448518"}, {"tags": ["x_sadp-csaf-vex"], "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28500.json"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:24977"}], "solutions": [{"lang": "en", "value": "RHSA-2026:24977: Red Hat OpenShift AI 2.25"}], "timeline": [{"lang": "en", "time": "2026-03-18T02:01:35.207Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-03-18T01:15:07.644Z", "value": "Made public."}], "title": "onnx: ONNX: Untrusted Model Repository Warnings Suppressed", "workarounds": [{"lang": "en", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}], "x_adpType": "supplier", "x_generator": {"engine": "sadp-cli 1.0.0"}, "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-07-15T01:11:41.016Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-28500", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-18T14:08:46.596652Z"}}}], "references": [{"url": "https://github.com/ZeroXJacks/CVEs/blob/main/2026/CVE-2026-28500.md", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-18T14:08:41.528Z"}}], "cna": {"title": "ONNX Untrusted Model Repository Warnings Suppressed by silent=True in onnx.hub.load() \u2014 Silent Supply-Chain Attack", "source": {"advisory": "GHSA-hqmj-h5c6-369m", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "onnx", "product": "onnx", "versions": [{"status": "affected", "version": "<= 1.20.1"}]}], "references": [{"url": "https://github.com/onnx/onnx/security/advisories/GHSA-hqmj-h5c6-369m", "name": "https://github.com/onnx/onnx/security/advisories/GHSA-hqmj-h5c6-369m", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/ZeroXJacks/CVEs/blob/main/2026/CVE-2026-28500.md", "name": "https://github.com/ZeroXJacks/CVEs/blob/main/2026/CVE-2026-28500.md", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. In versions up to and including 1.20.1, a security control bypass exists in onnx.hub.load() due to improper logic in the repository trust verification mechanism. While the function is designed to warn users when loading models from non-official sources, the use of the silent=True parameter completely suppresses all security warnings and confirmation prompts. This vulnerability transforms a standard model-loading function into a vector for Zero-Interaction Supply-Chain Attacks. When chained with file-system vulnerabilities, an attacker can silently exfiltrate sensitive files (SSH keys, cloud credentials) from the victim's machine the moment the model is loaded. As of time of publication, no known patched versions are available."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-345", "description": "CWE-345: Insufficient Verification of Data Authenticity"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-494", "description": "CWE-494: Download of Code Without Integrity Check"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-693", "description": "CWE-693: Protection Mechanism Failure"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-18T01:15:07.644Z"}}}, "cveMetadata": {"cveId": "CVE-2026-28500", "state": "PUBLISHED", "dateUpdated": "2026-03-18T14:08:50.003Z", "dateReserved": "2026-02-27T20:57:47.708Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-18T01:15:07.644Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "onnx", "vendor": "onnx", "versions": [{"status": "affected", "version": "<= 1.20.1"}]}], "source": "security-advisories@github.com"}, {"affectedData": [{"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:2.25::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9", "product": "Red Hat OpenShift AI 2.25", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1780078312", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:2.25::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9", "product": "Red Hat OpenShift AI 2.25", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1780078429", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:2.25::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9", "product": "Red Hat OpenShift AI 2.25", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1780069222", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:2.25::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9", "product": "Red Hat OpenShift AI 2.25", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1780078632", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:2.25::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9", "product": "Red Hat OpenShift AI 2.25", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1780078416", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:2.25::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9", "product": "Red Hat OpenShift AI 2.25", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1780417775", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:2.25::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9", "product": "Red Hat OpenShift AI 2.25", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1780078388", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:2.25::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9", "product": "Red Hat OpenShift AI 2.25", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1780069146", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:2.25::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9", "product": "Red Hat OpenShift AI 2.25", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1780078413", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:2.25::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9", "product": "Red Hat OpenShift AI 2.25", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1780069226", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:2.25::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9", "product": "Red Hat OpenShift AI 2.25", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1780078629", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:2.25::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9", "product": "Red Hat OpenShift AI 2.25", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1780078414", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:2.25::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9", "product": "Red Hat OpenShift AI 2.25", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1780078632", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:2.25::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9", "product": "Red Hat OpenShift AI 2.25", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1780069222", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "affected", "packageName": "rhoai/odh-openvino-model-server-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:linuxfoundation:onnx:*:*:*:*:*:*:*:*", "matchCriteriaId": "34920498-08A0-464E-B9F2-1562D29E3F26", "versionEndIncluding": "1.20.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. In versions up to and including 1.20.1, a security control bypass exists in onnx.hub.load() due to improper logic in the repository trust verification mechanism. While the function is designed to warn users when loading models from non-official sources, the use of the silent=True parameter completely suppresses all security warnings and confirmation prompts. This vulnerability transforms a standard model-loading function into a vector for Zero-Interaction Supply-Chain Attacks. When chained with file-system vulnerabilities, an attacker can silently exfiltrate sensitive files (SSH keys, cloud credentials) from the victim's machine the moment the model is loaded. As of time of publication, no known patched versions are available."}, {"lang": "es", "value": "Open Neural Network Exchange (ONNX) es un est\u00e1ndar abierto para la interoperabilidad de aprendizaje autom\u00e1tico. En versiones hasta la 1.20.1 inclusive, existe un bypass de control de seguridad en onnx.hub.load() debido a una l\u00f3gica incorrecta en el mecanismo de verificaci\u00f3n de confianza del repositorio. Aunque la funci\u00f3n est\u00e1 dise\u00f1ada para advertir a los usuarios al cargar modelos de fuentes no oficiales, el uso del par\u00e1metro silent=True suprime completamente todas las advertencias de seguridad y las solicitudes de confirmaci\u00f3n. Esta vulnerabilidad transforma una funci\u00f3n est\u00e1ndar de carga de modelos en un vector para ataques de cadena de suministro de interacci\u00f3n cero. Cuando se encadena con vulnerabilidades del sistema de archivos, un atacante puede exfiltrar silenciosamente archivos sensibles (claves SSH, credenciales de la nube) de la m\u00e1quina de la v\u00edctima en el momento en que se carga el modelo. Al momento de la publicaci\u00f3n, no hay versiones parcheadas conocidas disponibles."}], "id": "CVE-2026-28500", "lastModified": "2026-07-15T02:19:15.327", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.0, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.0, "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-28500", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-18T14:08:46.596652Z", "version": "2.0.3"}}]}, "published": "2026-03-18T02:16:24.227", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/ZeroXJacks/CVEs/blob/main/2026/CVE-2026-28500.md"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/onnx/onnx/security/advisories/GHSA-hqmj-h5c6-369m"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:24977"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/security/cve/CVE-2026-28500"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448518"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Patch"], "url": "https://github.com/ZeroXJacks/CVEs/blob/main/2026/CVE-2026-28500.md"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28500.json"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-345"}, {"lang": "en", "value": "CWE-494"}, {"lang": "en", "value": "CWE-693"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-829"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}]}

{"bugzilla": {"description": "onnx: ONNX: Untrusted Model Repository Warnings Suppressed", "id": "2448518", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448518"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.6", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-829", "details": ["A flaw was found in Open Neural Network Exchange (ONNX), an open standard for machine learning interoperability. A security control bypass exists in the `onnx.hub.load()` function due to improper logic in its repository trust verification. An attacker can exploit this by providing a malicious model, which, when loaded with the `silent=True` parameter, suppresses all security warnings. This vulnerability transforms a standard model-loading function into a vector for Zero-Interaction Supply-Chain Attacks."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-28500", "package_state": [{"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-openvino-model-server-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}], "public_date": "2026-03-18T01:15:07Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-28500\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-28500\nhttps://github.com/ZeroXJacks/CVEs/blob/main/2026/CVE-2026-28500.md\nhttps://github.com/onnx/onnx/security/advisories/GHSA-hqmj-h5c6-369m"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.20.1]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "onnx", "source": "cna", "vendor": "onnx"}, "product": "onnx", "vendor": "onnx"}], "analysis": {"en": {"generated_at": "2026-03-19T01:55:18.338879+00:00", "value": {"mitigation_remediation": ["Do not use silent=True in calls to onnx.hub.load() or remove the parameter entirely.", "Limit network access for ONNX models to trusted repositories only.", "Implement code reviews and static analysis to detect suppression of ONNX warnings.", "Monitor application logs for unexpected calls to onnx.hub.load().", "Stay updated and apply newer ONNX releases when they become available."], "summary": {"action": "Mitigate", "impact": "Silent model loading bypass leading to potential data exfiltration"}, "threat_synthesis": {"affected_systems": "Affected are the ONNX library supplied by the Linux Foundation, any release version 1.20.1 or earlier. The Common Platform Enumeration for the product is cpe:2.3:a:linuxfoundation:onnx:*:*:*:*:*:*:*:*. No patched release is available at the time of the advisory.", "description_and_impact": "The vulnerability exists in the ONNX library's onnx.hub.load() function. In versions up to 1.20.1 the function's logic that checks whether a model repository is trusted incorrectly allows the warning that normally alerts users when loading a model from a non\u2011official source to be suppressed if the caller passes silent=True. As a result, a malicious model can be loaded without the user seeing any warning. Together with a filesystem read or write flaw, the attacker could use this silent loading to exfiltrate sensitive files such as SSH keys or cloud credentials. The weakness is reflected in CWE\u2011345 (Missing Authorization), CWE\u2011494 (Exposed Functionality), CWE\u2011693 (Improper Handling of Secrets), and CWE\u2011829 (Privilege Escalation).", "risk_and_exploitability": "The issue has a CVSS score of 8.6, indicating high severity. The EPSS score is below 1%, suggesting that widespread exploitation is not yet common. It is not listed in the CISA KeV catalog. Exploitation requires an attacker to cause a program to call onnx.hub.load() with silent=True and provide a model from an untrusted repository. If the victim\u2019s system also contains a file\u2011system weakness that permits reading of sensitive files, the attacker could combine the two flaws to retrieve such data. The risk therefore increases if an application that automatically loads ONNX models is compromised or if an attacker can supply the model URL."}}}}, "created": "2026-03-18T10:42:20.169163+00:00", "updated": "2026-03-24T10:53:50.027700+00:00", "vendors": ["onnx", "onnx$PRODUCT$onnx"]}