ACVE-2026-0309

In the wild

demonstrated · vendor

Artifact

Payload

namespace-hijack · config

Platform status

huggingface · removed (checked 2026-09-20)

C2

—

Target

model resolution

File hashes

• None recorded.

Namespace

sberbank-ai · orphaned 2023-10-24

Description

What

Legit Security documented the risk that an abandoned Hugging Face organization name can be registered again after the legitimate owner moves to a new namespace. The current API redirect from sberbank-ai to ai-forever is a platform state, not a cryptographic identity. A future ownership transfer or deletion can change what a name resolves to.

Which configuration is exposed

The exposed configuration resolves a model by the sberbank-ai namespace without a revision pin and accepts the Hub redirect or successor content. The issue is a trust-boundary failure in name resolution; it does not claim that the current ai-forever target is malicious or that this example caused a victim incident.

How ACVE detects it

ACVE records the namespace and requires a namespace creation time after the orphan date or a revision outside a reviewed allowlist. A missing namespaceCreatedAt is unknown and therefore possible. The lock must capture namespace metadata at enrichment time because a later API response cannot reconstruct the original owner history.

Fix

Pin the exact reviewed revision and record the file hashes used by the loader. Remove unpinned sberbank-ai cache entries, verify the redirect target independently, and prefer a maintained upstream namespace with ownership controls. Rebuild the lock after any Hub rename or redirect.

Grounding needed

The redirect and retirement behaviour should be rechecked against the Hub API and the published namespace-reuse analysis. This is a researcher demonstration of a supply-chain condition, not proof of victim execution.

This record is limited to the condition named in the public source: Reused Hugging Face namespace can redirect a model to a successor owner. A match is a review signal for that condition, not a claim that every installation, package, model, or host was compromised. Operators should preserve the resolved evidence and investigate adjacent credentials, network exposure, and execution history before closing the finding. The result should be retained with the lock snapshot used for the match so later review can distinguish configuration drift from a changed public record.

Configuration

some models where
  and
    namespace eq "sberbank-ai"
    or
      namespaceCreatedAt gte "2023-10-25T00:00:00Z"
      revision notIn []

Fix

Pin a reviewed revision and avoid resolving abandoned namespaces by name.

• Reconfigure model.revision. A revision pin prevents a mutable namespace redirect.
• Remove ~/.cache/huggingface/hub/models--sberbank-ai--*/**.

Validation

No validation entries recorded.

Grounding

No grounding checks recorded.

References

REPORT

• https://www.legitsecurity.com/blog/tens-of-thousands-of-developers-were-potentially-impacted-by-the-hugging-face-aijacking-attack
• https://unit42.paloaltonetworks.com/model-namespace-reuse/