CVE-2026-28500: Trust Bypass in ONNX Runtime 1.9.0

The core impact of CVE-2026-28500 lies in the ability to execute arbitrary code within the context of the ONNX Runtime environment. An attacker can craft a malicious ONNX model hosted on a compromised or attacker-controlled GitHub repository. By setting silent=True, the user is unaware of the potential risks associated with downloading from an unverified source. The SHA256 integrity check, intended to validate the model's authenticity, is rendered ineffective because the manifest file used for verification resides within the same attacker-controlled repository, ensuring a consistent hash value. This allows the attacker to inject malicious code directly into the model, which will then be executed when the model is loaded and run, potentially leading to data breaches, system compromise, or denial of service.

1. Reserved2026-02-27
2. Published2026-03-16
3. Modified2026-04-06
4. EPSS updated2026-03-25

The primary mitigation for CVE-2026-28500 is to upgrade ONNX Runtime to version 1.21.0 or later, which addresses the trust bypass vulnerability. If upgrading is not immediately feasible, consider implementing a temporary workaround by strictly controlling the sources from which ONNX models are downloaded. Implement a policy requiring all model repositories to be verified and trusted before deployment. Additionally, consider using a Web Application Firewall (WAF) or proxy to inspect and filter incoming model files, looking for suspicious patterns or known malicious signatures. While a direct detection signature (Sigma/YARA) is difficult to create due to the nature of the vulnerability, monitoring for unusual ONNX Runtime behavior and unexpected model execution patterns can provide early warning signs. After upgrading, confirm the fix by attempting to load a model from an untrusted repository with silent=True and verifying that the trust warning is displayed.