Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, there is an issue in onnx.load, the code checks for symlinks to prevent path traversal, but completely misses hardlinks because a hardlink looks exactly like a regular file on the filesystem. This issue has been patched in version 1.21.0.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to
    version 1.21.0, there is an issue in onnx.load, the code checks for symlinks to prevent path traversal,
    but completely misses hardlinks because a hardlink looks exactly like a regular file on the filesystem.
    This issue has been patched in version 1.21.0. (CVE-2026-34446)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to     version 1.21.0, there is an issue in onnx.load, the code checks for symlinks to prevent path traversal,     but completely misses hardlinks because a hardlink looks exactly like a regular file on the filesystem.
    This issue has been patched in version 1.21.0. (CVE-2026-34446)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
457170	Echo: onnx: security update to 1.17.0-3+e1	Tenable Cloud Security	Echo Local Security Checks	Local	medium
457170	Echo: onnx: security update to 1.17.0-3+e1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
304717	Linux Distros Unpatched Vulnerability : CVE-2026-34446	Nessus	Misc.	Local	medium
439655	SCA: security update for onnx (GHSA-cmw6-hcpp-c6jp)	Tenable Cloud Security	SCA Checks	Local	medium
439655	SCA: security update for onnx (GHSA-cmw6-hcpp-c6jp)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-34446

medium

Tenable Plugins

medium

medium

medium

medium

medium