CVE-2026-34446: Arbitrary File Access in ONNX Runtime

The core of the vulnerability lies in the onnx.load function's failure to properly validate hardlinks. While the code checks for symbolic links to prevent path traversal, it completely overlooks hardlinks. Hardlinks, appearing as regular files on the filesystem, bypass all security checks within onnx/checker.cc because the validator only calls is_symlink() and doesn't inspect inode or link count. This allows an attacker to craft a malicious ONNX model containing a hardlink to a sensitive file on the victim's system. Upon loading this model, the attacker gains unauthorized access to the targeted file without triggering any alerts or security protections. The impact is particularly severe in AI supply chains, where a single compromised model can silently steal secrets from the victim's machine.

1. Reserved2026-03-27
2. Published2026-04-01
3. Modified2026-04-04
4. EPSS updated2026-04-09

The primary mitigation for CVE-2026-34446 is to upgrade to ONNX Runtime version 1.21.0 or later, which includes the necessary fix. If upgrading is not immediately feasible, consider implementing temporary workarounds. Restrict the sources of ONNX models loaded by your application to trusted providers only. Implement strict input validation on any user-provided data used in constructing ONNX models. Consider using a Web Application Firewall (WAF) or proxy to inspect incoming ONNX model files for suspicious patterns or hardlink structures. While a specific Sigma or YARA rule isn't readily available, monitoring for unusual file access patterns after loading ONNX models can provide early detection. After upgrading, confirm the fix by attempting to load a test ONNX model containing a hardlink to a known, non-sensitive file; it should be rejected.