VDB

CVE-2026-27489

CVE-2026-27489 PUBLISHED CVSS 8.699999809265137 HIGH

Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, a path traversal vulnerability via symlink allows to read arbitrary files outside model or user-provided directory. This issue has been patched in version 1.21.0.

EPSS 0.62% · 49.4th percentile

Risk Scores

CVSS 4.0
8.699999809265137
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS Score
0.62%
49.4th percentile

Affected Products

VendorProductVersions
Red HatRed Hat OpenShift AI 2.251780078629
PyPIonnx0
Red HatRed Hat OpenShift AI 2.251780417775
Red HatRed Hat OpenShift AI 2.251780078429
Red HatRed Hat OpenShift AI 2.251780069226
Red HatRed Hat OpenShift AI (RHOAI)
linuxfoundationonnx0
Red HatRed Hat OpenShift AI 2.251780078632
Red HatRed Hat OpenShift AI 2.251780078632
Red HatRed Hat OpenShift AI 2.251780078312
Red HatRed Hat OpenShift AI 2.251780069222
Red HatRed Hat OpenShift AI 2.251780069146
Red HatRed Hat OpenShift AI 2.251780078414
Red HatRed Hat OpenShift AI 2.251780069222
Red HatRed Hat OpenShift AI 2.251780078416
onnxonnx< 1.21.0
Red HatRed Hat OpenShift AI 2.251780078413
Red HatRed Hat OpenShift AI 2.251780078388

Timeline

  • Mar 31, 2026 CVE Published
  • Mar 31, 2026 PoC Published
  • Apr 1, 2026 PoC Published
  • Apr 3, 2026 PoC Published
  • Apr 6, 2026 CVE Updated
  • Apr 29, 2026 Security Advisory
  • May 18, 2026 EPSS Score
  • May 20, 2026 EPSS Score
  • May 21, 2026 EPSS Score
  • May 23, 2026 EPSS Score
  • May 24, 2026 EPSS Score
  • May 26, 2026 EPSS Score

References

Open in Interactive Console →
$ Console Community · 50/day Open console ›