CVE-2026-49114: ONNX Path Traversal Vulnerability

CVE-2026-49114 Overview

CVE-2026-49114 is a symlink-following vulnerability in the ONNX (Open Neural Network Exchange) library affecting versions before 1.21.0. The save_external_data function constructs an external-data file path from the model's external_data location field and opens it for writing without O_NOFOLLOW or O_EXCL flags. The write occurs after a non-atomic os.path.isfile() check, creating a time-of-check to time-of-use (TOCTOU) window. A local attacker with write access to the target directory can pre-plant a symlink, causing the victim's write to append to any file the victim can modify. The issue is fixed in ONNX 1.21.0 and tracked under [CWE-22].

Critical Impact
A local attacker can redirect the victim's serialization write to sensitive files such as ~/.ssh/authorized_keys, cron files, or application configuration files, enabling privilege escalation and persistence.

Affected Products

ONNX (Open Neural Network Exchange) versions prior to 1.21.0
Python applications using onnx.external_data_helper.save_external_data
ML pipelines that serialize ONNX models with external data in shared or attacker-writable directories

Discovery Timeline

2026-08-21 - CVE-2026-49114 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-49114

Vulnerability Analysis

The flaw is a symlink-following file write in the save_external_data routine of the ONNX library. When a model references external tensor data, ONNX constructs the destination file path by joining the base directory with the external_data location field taken from the model. Before writing, the code performs a non-atomic os.path.isfile() existence check, then opens the file for writing. The open() call does not include O_NOFOLLOW (which would refuse to follow symlinks) or O_EXCL (which would fail if the file already exists). This combination allows a local attacker to interpose a symlink between the check and the open, causing the file descriptor to point at an attacker-chosen target.

Root Cause

The vulnerability stems from two compounding issues. First, the file existence check and subsequent open are not atomic, producing a classic TOCTOU race. Second, the file is opened without protective flags that would refuse to traverse symbolic links. The ONNX library also trusts the external_data location field embedded in the model without normalizing or restricting it to the intended output directory. Fixed behavior in 1.21.0 addresses the unsafe open pattern.

Attack Vector

Exploitation requires local write access to the directory where the victim serializes ONNX external data. The attacker deterministically pre-plants a symlink named to match the expected external_data filename. When the victim calls save_external_data, the write follows the symlink and appends attacker-controlled bytes (the tensor payload) to the target file. Practical targets include ~/.ssh/authorized_keys for persistent SSH access, user crontab files for scheduled command execution, and application configuration files that alter runtime behavior. The attack is deterministic and does not require winning a race window in most deployments because the symlink can be placed before the victim invokes serialization.

See the GitHub Security Advisory GHSA-q56x-g2fj-4rj6 for the upstream advisory.

Detection Methods for CVE-2026-49114

Indicators of Compromise

Unexpected symbolic links inside directories used by ML pipelines or model export workflows, especially links whose names match anticipated external tensor filenames.
Unexplained appended content in sensitive user files such as ~/.ssh/authorized_keys, ~/.bashrc, crontab files, or service configuration files following an ONNX serialization run.
ONNX models containing unusual external_data location fields with relative traversal segments or filenames that collide with sensitive paths.

Detection Strategies

Inventory Python environments for installed onnx packages and flag any version below 1.21.0.
Statically inspect ONNX models before loading and reject models whose external_data location field contains path separators, traversal sequences, or symlink targets.
Audit filesystem events for symlink() or link() syscalls in directories consumed by ML training or inference services.

Monitoring Recommendations

Enable Linux audit rules on directories used for ONNX model serialization to log create, symlink, and open events.
Monitor for file modifications to authorized_keys, cron directories, and shell profile files by non-administrative users or ML workload accounts.
Alert when ML service accounts perform writes outside their designated model output directories.

How to Mitigate CVE-2026-49114

Immediate Actions Required

Upgrade ONNX to version 1.21.0 or later across all environments that load or export models.
Restrict directory permissions on ONNX serialization output paths so that only the invoking service account can write to them.
Validate the external_data location field of untrusted models and reject any value containing directory separators or traversal segments.

Patch Information

The issue is fixed in ONNX 1.21.0. Upgrade using pip install --upgrade "onnx>=1.21.0" or the equivalent package management workflow for your environment. Refer to the ONNX GitHub Security Advisory and the CVE-2026-49114 record for details.

Workarounds

Serialize ONNX external data only into freshly created, exclusively owned directories that no other local user can write to.
Run ONNX serialization under a dedicated low-privilege service account with no write access to home directories, cron paths, or system configuration.
Pre-flight untrusted models by stripping or overriding the external_data location field to a controlled filename before calling save_external_data.

bash

# Upgrade ONNX to the patched release
pip install --upgrade "onnx>=1.21.0"

# Verify installed version
python -c "import onnx; print(onnx.__version__)"