CVE-2026-1669
published 2026-02-11CVE-2026-1669: Arbitrary file read in the model loading mechanism (HDF5 integration) in Keras versions 3.0.0 through 3.13.1 on all supported platforms allows a remote…
PriorityP347high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
0.33%
25.5th percentile
Arbitrary file read in the model loading mechanism (HDF5 integration) in Keras versions 3.0.0 through 3.13.1 on all supported platforms allows a remote attacker to read local files and disclose sensitive information via a crafted .keras model file utilizing HDF5 external dataset references.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | keras | — | — |
| keras | >= 3.0.0 < 3.13.1 | 3.13.1 | |
| keras-team | keras-team_keras | >= unspecified < 3.12.2, 3.14.1 | 3.12.2, 3.14.1 |
| keras | keras | >= 0 < 3.12.3 | 3.12.3 |
| keras | keras | >= 3.0.0 < 3.12.1 | 3.12.1 |
| keras | keras | 3.0.0 – 3.13.1 | — |
| keras | keras | 3.0.0 – 3.13.1 | — |
| keras | keras | >= 3.13.0 < 3.13.2 | 3.13.2 |
| keras | keras | >= 3.13.0 < 3.15.0 | 3.15.0 |
| rhoai | odh-kserve-agent-rhel9 | — | — |
| rhoai | odh-kserve-controller-rhel9 | — | — |
| rhoai | odh-kserve-router-rhel9 | — | — |
| rhoai | odh-kserve-storage-initializer-rhel9 | — | — |
| rhoai | odh-modelmesh-runtime-adapter-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-tensorflow-cuda-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-tensorflow-rocm-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-tensorflow-cuda-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-tensorflow-rocm-py312-rhel9 | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv4.07.1HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
ghsa7.5HIGH
osv7.1HIGH
vendor_redhat7.8HIGH
vendor_debian7.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Keras versions up to and including 3.13.2 are vulnerable to an arbitrary HDF5 file read due to an incomplete fix for CVE-2026-1669.
ghsa_unreviewed·2026-07-01·CVSS 7.5
CVE-2026-12480 [HIGH] CWE-73 Keras versions up to and including 3.13.2 are vulnerable to an arbitrary HDF5 file read due to an incomplete fix for CVE-2026-1669.
Keras versions up to and including 3.13.2 are vulnerable to an arbitrary HDF5 file read due to an incomplete fix for CVE-2026-1669. The vulnerability resides in the `H5IOStore._verify_dataset()` and `file_editor.py` methods, which fail to check the `dataset.is_virtual` property of HDF5 datasets. This allows an attacker to craft a malicious `.keras` model archive or `.h5` weights file containing a Virtual Dataset (VDS) that references external HDF5 files on the victim's filesystem. When the victim loads the model using `keras.models.load_model()` or `keras.saving.load_model()`, the external file is transparently read, leading to potential information disclosure. Fixed in versions 3.12.2 and 3.14.1.
GHSA
Keras: HDF5 virtual datasets can disclose local files
ghsa·2026-07-01·CVSS 7.5
CVE-2026-12480 [HIGH] CWE-73 Keras: HDF5 virtual datasets can disclose local files
Keras: HDF5 virtual datasets can disclose local files
Keras versions up to and including 3.13.2 are vulnerable to an arbitrary HDF5 file read due to an incomplete fix for CVE-2026-1669. The vulnerability resides in the `H5IOStore._verify_dataset()` and `file_editor.py` methods, which fail to check the `dataset.is_virtual` property of HDF5 datasets. This allows an attacker to craft a malicious `.keras` model archive or `.h5` weights file containing a Virtual Dataset (VDS) that references external HDF5 files on the victim's filesystem. When the victim loads the model using `keras.models.load_model()` or `keras.saving.load_model()`, the external file is transparently read, leading to potential information disclosure. Fixed in versions 3.12.3 and 3.15.0.
GHSA
Keras has a Local File Disclosure via HDF5 External Storage During Keras Weight Loading
ghsa·2026-02-18
CVE-2026-1669 [HIGH] CWE-200 Keras has a Local File Disclosure via HDF5 External Storage During Keras Weight Loading
Keras has a Local File Disclosure via HDF5 External Storage During Keras Weight Loading
## Summary
TensorFlow / Keras continues to honor HDF5 “external storage” and `ExternalLink` features when loading weights. A malicious `.weights.h5` (or a `.keras` archive embedding such weights) can direct `load_weights()` to read from an arbitrary readable filesystem path. The bytes pulled from that path populate model tensors and become observable through inference or subsequent re-save operations. Keras “safe mode” only guards object deserialization and does not cover weight I/O, so this behaviour persists even with safe mode enabled. The issue is confirmed on the latest publicly released stack (`tensorflow 2.20.0`, `keras 3.11.3`, `h5py 3.15.1`, `numpy 2.3.4`).
## Impact
- **Class**: CWE-200 (E
OSV
Keras has a Local File Disclosure via HDF5 External Storage During Keras Weight Loading
osv·2026-02-18
CVE-2026-1669 [HIGH] Keras has a Local File Disclosure via HDF5 External Storage During Keras Weight Loading
Keras has a Local File Disclosure via HDF5 External Storage During Keras Weight Loading
## Summary
TensorFlow / Keras continues to honor HDF5 “external storage” and `ExternalLink` features when loading weights. A malicious `.weights.h5` (or a `.keras` archive embedding such weights) can direct `load_weights()` to read from an arbitrary readable filesystem path. The bytes pulled from that path populate model tensors and become observable through inference or subsequent re-save operations. Keras “safe mode” only guards object deserialization and does not cover weight I/O, so this behaviour persists even with safe mode enabled. The issue is confirmed on the latest publicly released stack (`tensorflow 2.20.0`, `keras 3.11.3`, `h5py 3.15.1`, `numpy 2.3.4`).
## Impact
- **Class**: CWE-200 (E
OSV
Duplicate Advisory: Keras vulnerable to arbitrary file read in the model loading mechanism (HDF5 integration)
osv·2026-02-12
CVE-2026-1669 [HIGH] Duplicate Advisory: Keras vulnerable to arbitrary file read in the model loading mechanism (HDF5 integration)
Duplicate Advisory: Keras vulnerable to arbitrary file read in the model loading mechanism (HDF5 integration)
## Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-3m4q-jmj6-r34q. This link is maintained to preserve external references.
## Original Description
Arbitrary file read in the model loading mechanism (HDF5 integration) in Keras versions 3.0.0 through 3.13.1 on all supported platforms allows a remote attacker to read local files and disclose sensitive information via a crafted .keras model file utilizing HDF5 external dataset references.
OSV
CVE-2026-1669: Arbitrary file read in the model loading mechanism (HDF5 integration) in Keras versions 3
osv·2026-02-11·CVSS 7.1
CVE-2026-1669 [HIGH] CVE-2026-1669: Arbitrary file read in the model loading mechanism (HDF5 integration) in Keras versions 3
Arbitrary file read in the model loading mechanism (HDF5 integration) in Keras versions 3.0.0 through 3.13.1 on all supported platforms allows a remote attacker to read local files and disclose sensitive information via a crafted .keras model file utilizing HDF5 external dataset references.
Red Hat
kernel: drm/xe/userptr: Hold notifier_lock for write on inject test path
vendor_redhat·2026-08-28·CVSS 7.8
CVE-2026-80606 [HIGH] CWE-413 kernel: drm/xe/userptr: Hold notifier_lock for write on inject test path
kernel: drm/xe/userptr: Hold notifier_lock for write on inject test path
In the Linux kernel, the following vulnerability has been resolved:
drm/xe/userptr: Hold notifier_lock for write on inject test path
When CONFIG_DRM_XE_USERPTR_INVAL_INJECT=y, xe_pt_svm_userptr_pre_commit()
runs vma_check_userptr() with the svm notifier_lock taken for read. The
test injection causes vma_check_userptr() to call
xe_vma_userptr_force_invalidate(), which feeds into
xe_vma_userptr_do_inval() with drm_gpusvm_ctx.in_notifier=true. That
flag tells drm_gpusvm_unmap_pages() the caller already holds
notifier_lock for write and only asserts the mode. Because the caller
actually holds it for read, the assertion fires:
WARNING: drivers/gpu/drm/drm_gpusvm.c:1669 at \
drm_gpusvm_unmap_pages+0xd4/0x130 [drm_gpusvm_he
Red Hat
keras: Keras: Information disclosure via malicious model archive with Virtual Dataset
vendor_redhat·2026-07-01·CVSS 5.5
CVE-2026-12480 [MEDIUM] CWE-22 keras: Keras: Information disclosure via malicious model archive with Virtual Dataset
keras: Keras: Information disclosure via malicious model archive with Virtual Dataset
Keras versions up to and including 3.13.2 are vulnerable to an arbitrary HDF5 file read due to an incomplete fix for CVE-2026-1669. The vulnerability resides in the `H5IOStore._verify_dataset()` and `file_editor.py` methods, which fail to check the `dataset.is_virtual` property of HDF5 datasets. This allows an attacker to craft a malicious `.keras` model archive or `.h5` weights file containing a Virtual Dataset (VDS) that references external HDF5 files on the victim's filesystem. When the victim loads the model using `keras.models.load_model()` or `keras.saving.load_model()`, the external file is transparently read, leading to potential information disclosure. Fixed in versions 3.12.2 and 3.14.1.
A fla
Red Hat
keras: Keras: Information disclosure via arbitrary file read in model loading mechanism
vendor_redhat·2026-02-11·CVSS 7.1
CVE-2026-1669 [HIGH] CWE-73 keras: Keras: Information disclosure via arbitrary file read in model loading mechanism
keras: Keras: Information disclosure via arbitrary file read in model loading mechanism
Arbitrary file read in the model loading mechanism (HDF5 integration) in Keras versions 3.0.0 through 3.13.1 on all supported platforms allows a remote attacker to read local files and disclose sensitive information via a crafted .keras model file utilizing HDF5 external dataset references.
A flaw was found in Keras. A remote attacker can exploit an arbitrary file read vulnerability in the model loading mechanism (HDF5 integration) by providing a specially crafted .keras model file that utilizes HDF5 external dataset references. This allows the attacker to read local files and disclose sensitive information.
Statement: This IMPORTANT flaw in Keras allows for arbitrary file read operations. Red Hat Op
Debian
CVE-2026-1669: keras - Arbitrary file read in the model loading mechanism (HDF5 integration) in Keras v...
vendor_debian·2026·CVSS 7.1
CVE-2026-1669 [HIGH] CVE-2026-1669: keras - Arbitrary file read in the model loading mechanism (HDF5 integration) in Keras v...
Arbitrary file read in the model loading mechanism (HDF5 integration) in Keras versions 3.0.0 through 3.13.1 on all supported platforms allows a remote attacker to read local files and disclose sensitive information via a crafted .keras model file utilizing HDF5 external dataset references.
Scope: local
bullseye: open
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-80606 kernel: drm/xe/userptr: Hold notifier_lock for write on inject test path
bugzilla·2026-08-28·CVSS 7.8
CVE-2026-80606 [HIGH] CVE-2026-80606 kernel: drm/xe/userptr: Hold notifier_lock for write on inject test path
CVE-2026-80606 kernel: drm/xe/userptr: Hold notifier_lock for write on inject test path
In the Linux kernel, the following vulnerability has been resolved:
drm/xe/userptr: Hold notifier_lock for write on inject test path
When CONFIG_DRM_XE_USERPTR_INVAL_INJECT=y, xe_pt_svm_userptr_pre_commit()
runs vma_check_userptr() with the svm notifier_lock taken for read. The
test injection causes vma_check_userptr() to call
xe_vma_userptr_force_invalidate(), which feeds into
xe_vma_userptr_do_inval() with drm_gpusvm_ctx.in_notifier=true. That
flag tells drm_gpusvm_unmap_pages() the caller already holds
notifier_lock for write and only asserts the mode. Because the caller
actually holds it for read, the assertion fires:
WARNING: drivers/gpu/drm/drm_gpusvm.c:1669 at \
drm_gpusvm_unmap_pages+0xd4/0x
Bugzilla
CVE-2026-12480 keras: Keras: Information disclosure via malicious model archive with Virtual Dataset
bugzilla·2026-07-01·CVSS 5.5
CVE-2026-12480 [MEDIUM] CVE-2026-12480 keras: Keras: Information disclosure via malicious model archive with Virtual Dataset
CVE-2026-12480 keras: Keras: Information disclosure via malicious model archive with Virtual Dataset
Keras versions up to and including 3.13.2 are vulnerable to an arbitrary HDF5 file read due to an incomplete fix for CVE-2026-1669. The vulnerability resides in the `H5IOStore._verify_dataset()` and `file_editor.py` methods, which fail to check the `dataset.is_virtual` property of HDF5 datasets. This allows an attacker to craft a malicious `.keras` model archive or `.h5` weights file containing a Virtual Dataset (VDS) that references external HDF5 files on the victim's filesystem. When the victim loads the model using `keras.models.load_model()` or `keras.saving.load_model()`, the external file is transparently read, leading to potential information disclosure. Fixed in versions 3.12.2 and
Wiz
CVE-2026-1669 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.1
CVE-2026-1669 [HIGH] CVE-2026-1669 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-1669 :
Python vulnerability analysis and mitigation
Arbitrary file read in the model loading mechanism (HDF5 integration) in Keras versions 3.0.0 through 3.13.1 on all supported platforms allows a remote attacker to read local files and disclose sensitive information via a crafted .keras model file utilizing HDF5 external dataset references.
Source : NVD
## 7.1
Score
Published February 11, 2026
Severity HIGH
CNA Score 7.1
Affected Technologies
Python
Wolfi
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 2.4
Exploitation Probability (EPSS) N/A
Affected packages and libraries
tensorflow-cpu-jupyter
keras
Sources
NVD
Chainguard Has Fix Added at: Feb 20, 2026
Debian 11
2026-02-11
Published