CVE-2026-11329: Weak Hash in ONNX MLIR Node Cache Handler

Technical summary

The vulnerability exists in the `generate_hash_key` function within `src/Runtime/python/torch_onnxmlir/src/torch_onnxmlir/backend.py`, which is part of ONNX MLIR's Placeholder Node Cache Handler. The function implements weak cryptographic hashing (CWE-327) and uses incorrect hash algorithms (CWE-328), allowing hash collisions or predictable cache key generation. ONNX MLIR versions up to 0.5.0.0 are affected. An attacker with local system access and user-level privileges can manipulate cache entries through hash collision or prediction, potentially corrupting model computation results or causing the runtime to fail integrity checks. The CVSS 3.1 score of 3.6 reflects the low attack vector (local only), high attack complexity, low privileges required, and minor impact on integrity and availability.

Business impact

For organizations deploying ONNX MLIR in shared compute environments or containerized systems, this vulnerability poses a risk of unauthorized model cache poisoning by co-located users. An attacker could alter cached model outputs without detection, leading to silent computational errors in machine learning pipelines. While the impact per-incident is limited to integrity and availability rather than data breach, the difficult-to-detect nature of cache manipulation could delay incident response. The risk is primarily relevant to multi-tenant machine learning platforms, research clusters, and shared GPU environments where untrusted local users may have system access.

Affected systems

ONNX MLIR versions up to and including 0.5.0.0 are affected. The vulnerability is specific to the Python runtime component (`torch_onnxmlir`) and impacts systems using ONNX MLIR for model inference, particularly those relying on the node cache optimization. Patched version information should be verified against the official ONNX MLIR release notes; the patch commit is identified as 72c5187ff6d13c2c2b3d3789b8f5faf99f08a5b4.

Exploitability

Exploitation is rated as difficult and requires a high level of attack complexity. An attacker must have local system access and user-level privileges (not root). They must understand the cache key generation mechanism, craft a deliberate hash collision or prediction attack, and execute it during active model inference. The attack does not propagate remotely and offers no privilege escalation. No known public exploits or in-the-wild abuse have been reported, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog, reflecting the combination of restricted attack surface and high technical barriers.

Remediation

Update ONNX MLIR to a version released after 0.5.0.0 that includes cryptographic fixes to the hash key generation function. Verify the applied patch against commit 72c5187ff6d13c2c2b3d3789b8f5faf99f08a5b4 in the official repository. Until patching is complete, restrict local system access to trusted users only, implement kernel-level access controls to isolate inference processes, and monitor cache hit/miss patterns for anomalies that might indicate tampering.

Patch guidance

Check the official ONNX MLIR GitHub repository for releases published after June 5, 2026, and verify inclusion of commit 72c5187ff6d13c2c2b3d3789b8f5faf99f08a5b4. Patch priority is low but should be included in regular maintenance windows for any shared or multi-tenant deployment. Test the patch in a pre-production environment with representative model workloads to ensure cache behavior remains correct and performance is unaffected. Document the patch version in your ONNX MLIR inventory.

Detection guidance

Monitor for unexpected cache key collisions or repeated cache invalidation events in ONNX MLIR runtime logs. Implement file integrity monitoring on the `backend.py` module and related cache directories to detect unauthorized modifications. On multi-user systems, audit local user login sessions during the same time window as anomalous model inference results. Check process execution logs for unusual patterns of model inference requests that bypass cache or trigger frequent recomputation. Correlation of these signals may indicate active exploitation attempts.

Why prioritize this

This vulnerability merits low to medium priority in patch queues. While the CVSS score is low (3.6), the attack vector and complexity are restrictive, which aligns with the low severity rating. Prioritize patching for shared inference clusters, research HPC systems, and containerized ML platforms where local user isolation is imperfect. Organizations with single-tenant deployments or strict access controls can defer patching to the next scheduled maintenance cycle. Given the difficulty of exploitation, this should not displace critical or high-severity vulnerability remediation efforts.

Risk score, explained

The CVSS 3.1 score of 3.6 (LOW) is driven by the requirement for local access (AV:L), high attack complexity (AC:H), and the need for user-level privileges (PR:L). Although the vulnerability affects both integrity (I:L) and availability (A:L), the confluence of these constraints means real-world exploitation is unlikely. The vulnerability does not affect confidentiality. Organizations without multi-tenant or shared-access patterns face minimal risk. Even in higher-risk environments, the difficulty of exploitation relative to other attack vectors makes this a lower-priority remediation target.

Frequently asked questions