Critical severity · published Mar 18, 2026
CVE-2026-28500
ONNX Untrusted Model Repository Warnings Suppressed by silent=True in onnx.hub.load() — Silent Supply-Chain Attack
9.1
CVSS
0.3%
EPSS
No
On KEV
Description
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. In versions up to and including 1.20.1, a security control bypass exists in onnx.hub.load() due to improper logic in the repository trust verification mechanism. While the function is designed to warn users when loading models from non-official sources, the use of the silent=True parameter completely suppresses all security warnings and confirmation prompts. This vulnerability transforms a standard model-loading function into a vector for Zero-Interaction Supply-Chain Attacks. When chained with file-system vulnerabilities, an attacker can silently exfiltrate sensitive files (SSH keys, cloud credentials) from the victim's machine the moment the model is loaded. As of time of publication, no known patched versions are available.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 25% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ON
onnx · onnx
<= 1.20.1 · source: vendor, NVD
RH
Red Hat OpenShift AI (RHOAI) · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat OpenShift AI 2.25 · Red Hat
All versions, or not specified · source: CISA
Affected product
ON
onnx
onnx
More from onnx
9.1
CVE-2024-7776
A vulnerability in the `download_model` function of the onnx/onnx framework, before and including version 1.16.1, allows for arbitrary file overwrite due to inadequate prevention…
8.6
CVE-2026-34445
ONNX: Malicious ONNX models can crash servers by exploiting unprotected object settings.
7.5
CVE-2026-27489
ONNX: Path Traversal via Symlink
7.1
CVE-2026-49114
ONNX symlink-following and path-traversal arbitrary file write
6.2
CVE-2026-115922
ONNX: Denial of service via unchecked expansion of packed sub-byte tensors in ONNX Python APIs