ONNX: 外部データ (ExternalData) ハードリンクバイパスによる任意のファイル読み出し ONNX ロード時

The core of the vulnerability lies in the onnx.load function's failure to properly validate hardlinks. While the code checks for symbolic links to prevent path traversal, it completely overlooks hardlinks. Hardlinks, appearing as regular files on the filesystem, bypass all security checks within onnx/checker.cc because the validator only calls is_symlink() and doesn't inspect inode or link count. This allows an attacker to craft a malicious ONNX model containing a hardlink to a sensitive file on the victim's system. Upon loading this model, the attacker gains unauthorized access to the targeted file without triggering any alerts or security protections. The impact is particularly severe in AI supply chains, where a single compromised model can silently steal secrets from the victim's machine.

Organizations heavily reliant on ONNX Runtime for machine learning inference, particularly those integrating models from external sources or using shared hosting environments, are at increased risk. Environments utilizing older versions of ONNX Runtime (≤1.9.0) are directly vulnerable. AI/ML development teams and DevOps engineers responsible for model deployment are key stakeholders.

• python / onnx:

import os
import onnx

def check_hardlink(filepath):
    try:
        st = os.stat(filepath)
        if st.st_nlink > 1:
            print(f"Potential hardlink detected: {filepath}")
    except FileNotFoundError:
        pass

# Example usage: Check a file path
check_hardlink('/path/to/your/onnx/model.onnx')

• generic web: Inspect ONNX model files for unusual file paths or hardlink indicators using tools like ls -l or stat to check the link count.

1. 2026-04-01Disclosure

   disclosure

1. 予約済み2026-03-27
2. 公開日2026-04-01
3. 更新日2026-04-04
4. EPSS 更新日2026-04-09

The primary mitigation for CVE-2026-34446 is to upgrade to ONNX Runtime version 1.21.0 or later, which includes the necessary fix. If upgrading is not immediately feasible, consider implementing temporary workarounds. Restrict the sources of ONNX models loaded by your application to trusted providers only. Implement strict input validation on any user-provided data used in constructing ONNX models. Consider using a Web Application Firewall (WAF) or proxy to inspect incoming ONNX model files for suspicious patterns or hardlink structures. While a specific Sigma or YARA rule isn't readily available, monitoring for unusual file access patterns after loading ONNX models can provide early detection. After upgrading, confirm the fix by attempting to load a test ONNX model containing a hardlink to a known, non-sensitive file; it should be rejected.