Immich shuts off the Microsoft telemetry that ONNX Runtime silently enabled in its machine-learning container

November 4, 2026. Immich merges a fix that disables ONNX Runtime telemetry by default in its machine-learning container. August 12, 2026. A user had opened issue #30729 documenting that ONNX Runtime 1.29, published by Microsoft, shipped with telemetry enabled by default on POSIX builds. November 4, 2026. The fix ships in Immich 3.3.6. Why it matters: the number-one argument for self-hosting is privacy, and a single transitive dependency quietly broke it.

The flaw is not Immich’s, but its dependency’s

The immich-machine-learning container runs AI models for facial recognition, semantic search and object detection. To do that it leans on ONNX Runtime, Microsoft’s inference engine. Immich declared its dependency with a wide range — onnxruntime>=1.23.2,<2 — which let version 1.29 in with no extra condition.

That range actually covered four variants — cpu, armnn, rknn and cuda (via onnxruntime-gpu) — all within reach of the affected 1.29 wheels. That is several entry points through which telemetry could slip in, depending on the hardware you host on.

ONNX Runtime 1.29 introduced a quiet change: on native Linux, macOS, Android and iOS builds, telemetry is compiled in and enabled by default, unless built with --no_telemetry or unless ORT_DISABLE_TELEMETRY=1 is set before initialization. The collector is Microsoft’s 1DS endpoint, at https://mobile.events.data.microsoft.com/OneCollector/1.0. In plain terms: a self-hosted container, meant to send nothing outward, could start phoning Microsoft on the first lockfile refresh.

This is why the episode stings. Self-hosters choose Immich precisely to keep their photos — faces, locations, metadata — off someone else’s servers. A silent outbound telemetry flow from the ML container does not leak the photos, but it does break the mental model: the box you control quietly began sending hardware and usage fingerprints to a vendor you never opted into.

What the telemetry collects — and what it does not

Issue #30729 is worth reading for its rigor: its author unpacked the official 1.29 archives and confirmed the presence of markers like Microsoft::Applications::Events, modelGraphHash and ORT_DISABLE_TELEMETRY, all absent from the 1.28 binaries. The payload is documented in the POSIX collector’s source. Events can include:

• a persistent, hashed device identifier, whose underlying UUID is stored under ~/.cache/Microsoft/DeveloperTools/.onnxruntime/;
• the OS description, architecture, CPU model, core count and total memory;
• model metadata: producer, version, domain, graph names, graph and weight hashes, execution providers and their versions;
• scrubbed error information and aggregated performance measurements.

The collector also keeps an offline event cache, so events are retained locally before upload — meaning the trail exists on your disk even when the network is down. None of this is surfaced to the Immich operator: it runs entirely at the dependency level, below Immich’s own observability.

The author found no evidence that input tensors, photos or videos are transmitted. That is beside the point: it is a new outbound flow of pseudonymous, system, hardware and usage information from a self-hosted service — and it is independent of Immich’s IMMICH_TELEMETRY_INCLUDE setting. Leaving that empty disables nothing.

Three months between detection and fix

The timeline deserves attention. The issue was opened on August 12, 2026, with a full technical analysis — binary evidence included, hashes of the official 1.28 and 1.29 archives compared, telemetry markers found in the Linux binary and absent from the 1.28 control. Immich’s fix only landed on November 4, 2026, nearly three months later. Throughout that window the risk stayed latent: Immich’s lockfile still pointed at ONNX Runtime 1.26, so existing installs sent nothing — but any dependency refresh could flip an install to telemetry-enabled 1.29 with no warning to the user. That is the nature of a dependency regression: it sleeps until a build wakes it.

The fix, and what to do depending on your version

Immich moved fast. On November 4, 2026, the issue was closed by pull request #32956, and the fix landed in 3.3.6. On an up-to-date install, a version bump is enough: ONNX Runtime telemetry is now disabled by default in the image.

If you are a few versions behind, the workaround is a single environment variable added to the machine-learning service of your docker-compose.yml, before Python imports ONNX Runtime:

  immich-machine-learning:
    environment:
      - ORT_DISABLE_TELEMETRY=1

The variable prevents uploader initialization, event emission and device-ID persistence for the whole process lifetime — an end-to-end safeguard, independent of version.

Auditing your own containers, beyond Immich

The episode is a lesson for everything you run at home. Telemetry does not announce itself: it is something you go looking for. Two reflexes are enough to catch it, without a heavy audit:

• list the opt-out variables of the inference dependencies you embed — ORT_DISABLE_TELEMETRY for ONNX Runtime, but every engine has its own equivalent;
• watch your containers’ outbound DNS: a call to mobile.events.data.microsoft.com or any unknown collection domain is the most reliable signal that a dependency changed its behavior.

Immich, for its part, confirmed its responsiveness by shipping the fix in 3.3.6 and preparing 3.4.0, whose beta finally brings tags to mobile — a feature users had awaited since August 2024. A project can introduce a dependency regression and fix it fast; what matters is the traceability of the fix and how quickly the team owns the problem.

The problem extends beyond Immich. ONNX Runtime is one of the most widespread inference engines in self-hosting: it sits behind image recognition, speech synthesis and semantic search in dozens of applications you run at home. Every project that embeds it without setting the opt-out variable inherits the same flaw, silently, on its own dependency-refresh cadence. This is not an isolated bug in Immich, but a Microsoft default whose reach spans the whole ecosystem — and one every self-hoster should check for themselves.

Verdict

This is not an exploitable vulnerability, and no sensitive data — photo or video — was transmitted. It is a more awkward reminder: “self-hosted” does not mean “no third-party outbound traffic.” One transitive dependency, bumped without review, was enough to reopen a channel Immich had worked hard to keep closed.

If you run Immich, move to 3.3.6 without delay: the fix is official and restores the expected behavior. If you are pinned to an older version, set ORT_DISABLE_TELEMETRY=1 on the machine-learning container and audit your other inference dependencies — the same flaw can exist in any project that embeds ONNX Runtime without auditing it. The lesson applies to all of self-hosting: privacy is defended in the dependencies, not just in the choice of application.

References

• GitHub — immich-app/immich issue #30729: ONNX Runtime 1.29 telemetry default (August 12, 2026)
• GitHub — Immich release v3.3.6
• Microsoft — onnxruntime docs/Privacy.md
• selfh.st — Self-Host Weekly (November 6, 2026)
• dev.to — Immich ML Privacy Issue: Microsoft Telemetry Enabled by Default via ONNX Runtime