Security readout for executives and security teams
Plain-English summary
ONNX can load machine-learning models from remote repositories. In affected versions, a setting intended to reduce output can also suppress trust warnings. That can let risky model sources appear normal to users or automation, creating supply-chain risk in ML workflows that load external models.
Executive priority
Treat this as a high-priority ML supply-chain control issue, not a broad internet-facing emergency. Prioritize teams that import third-party models or run automated model-loading workflows with secrets nearby.
Technical view
In ONNX versions up to and including 1.20.1, onnx.hub.load() trust verification can be bypassed because silent=True suppresses warnings and confirmation prompts for non-official repositories. The bundle reports high severity, CVSS 8.6, and potential sensitive-file exposure when chained with separate filesystem vulnerabilities.
Likely exposure
Exposure is most likely in Python environments using ONNX <= 1.20.1 and code paths that call onnx.hub.load() with silent=True, especially when models come from non-official or user-controlled repositories.
Exploitation context
The bundle does not show CISA KEV listing or cited active exploitation. Reported impact depends on a vulnerable loading workflow and may require chaining with other file-system issues to access sensitive files.
Researcher notes
Provided evidence names the vulnerable function and suppression behavior, but does not include exploit telemetry or an upstream fixed ONNX version. Red Hat advisories are referenced, so downstream package status may differ from upstream status.
Mitigation direction
- Avoid silent=True when loading models from non-official repositories.
- Restrict ONNX model sources to approved, trusted repositories.
- Isolate model-loading jobs from SSH keys, cloud credentials, and production secrets.
- Check ONNX and Red Hat advisories for available fixed packages or guidance.
- Add policy review for external model imports in ML pipelines.
Validation and detection
- Inventory installed ONNX versions and flag versions <= 1.20.1.
- Search code for onnx.hub.load() calls using silent=True.
- Review whether loaded model repositories are official or explicitly trusted.
- Confirm model-loading environments lack access to sensitive local credentials.
- Check Red Hat advisory RHSA-2026:24977 if using Red Hat packages.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-345: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-494: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-693: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-829: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-28500 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.6 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N3.94GitHub_MCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N3.94redhat-SADPVulnerability scoring details
Base CVSS 3.1 score
8.6HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Base CVSS 3.1 score
8.6HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- ADP timelineredhat-SADP
Made public.
- CVE publishedCVE Program
The CVE record was published.
- ADP timelineredhat-SADP
Reported to Red Hat.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2026-03-18T02:01:35.207Z: Reported to Red Hat.
- 2026-03-18T01:15:07.644Z: Made public.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/onnx/onnx/security/advisories/GHSA-hqmj-h5c6-369mCVE reference, GitHub_M · x_refsource_CONFIRM
- https://github.com/ZeroXJacks/CVEs/blob/main/2026/CVE-2026-28500.mdCVE reference, GitHub_M · x_refsource_MISC
- https://access.redhat.com/security/cve/CVE-2026-28500CVE reference, redhat-SADP · vdb-entry, x_refsource_REDHAT
- RHBZ#2448518CVE reference, redhat-SADP · issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28500.jsonCVE reference, redhat-SADP · x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:24977CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Insufficient Verification of Data Authenticity
Insufficient Verification of Data Authenticity represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Download of Code Without Integrity Check
Download of Code Without Integrity Check represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Protection Mechanism Failure
Protection Mechanism Failure represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Inclusion of Functionality from Untrusted Control Sphere
Inclusion of Functionality from Untrusted Control Sphere represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.