CVE-2026-1669
published 2026-02-11CVE-2026-1669: Arbitrary file read in the model loading mechanism (HDF5 integration) in Keras versions 3.0.0 through 3.13.1 on all supported platforms allows a remote…
PriorityP347high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
0.30%
22.0th percentile
Arbitrary file read in the model loading mechanism (HDF5 integration) in Keras versions 3.0.0 through 3.13.1 on all supported platforms allows a remote attacker to read local files and disclose sensitive information via a crafted .keras model file utilizing HDF5 external dataset references.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | keras | — | — |
| keras | >= 3.0.0 < 3.13.1 | 3.13.1 | |
| keras-team | keras-team_keras | >= unspecified < 3.12.2, 3.14.1 | 3.12.2, 3.14.1 |
| keras | keras | >= 3.0.0 < 3.12.1 | 3.12.1 |
| keras | keras | 3.0.0 – 3.13.1 | — |
| keras | keras | 3.0.0 – 3.13.1 | — |
| keras | keras | >= 3.13.0 < 3.13.2 | 3.13.2 |
| rhoai | odh-kserve-agent-rhel9 | — | — |
| rhoai | odh-kserve-controller-rhel9 | — | — |
| rhoai | odh-kserve-router-rhel9 | — | — |
| rhoai | odh-kserve-storage-initializer-rhel9 | — | — |
| rhoai | odh-modelmesh-runtime-adapter-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-tensorflow-cuda-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-tensorflow-rocm-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-tensorflow-cuda-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-tensorflow-rocm-py312-rhel9 | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv4.07.1HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv7.1HIGH
vendor_debian7.1HIGH
vendor_redhat7.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Keras versions up to and including 3.13.2 are vulnerable to an arbitrary HDF5 file read due to an incomplete fix for CVE-2026-1669.
ghsa_unreviewed·2026-07-01·CVSS 7.5
CVE-2026-12480 [HIGH] CWE-73 Keras versions up to and including 3.13.2 are vulnerable to an arbitrary HDF5 file read due to an incomplete fix for CVE-2026-1669.
Keras versions up to and including 3.13.2 are vulnerable to an arbitrary HDF5 file read due to an incomplete fix for CVE-2026-1669. The vulnerability resides in the `H5IOStore._verify_dataset()` and `file_editor.py` methods, which fail to check the `dataset.is_virtual` property of HDF5 datasets. This allows an attacker to craft a malicious `.keras` model archive or `.h5` weights file containing a Virtual Dataset (VDS) that references external HDF5 files on the victim's filesystem. When the victim loads the model using `keras.models.load_model()` or `keras.saving.load_model()`, the external file is transparently read, leading to potential information disclosure. Fixed in versions 3.12.2 and 3.14.1.
GHSA
Keras has a Local File Disclosure via HDF5 External Storage During Keras Weight Loading
ghsa·2026-02-18
CVE-2026-1669 [HIGH] CWE-200 Keras has a Local File Disclosure via HDF5 External Storage During Keras Weight Loading
Keras has a Local File Disclosure via HDF5 External Storage During Keras Weight Loading
## Summary
TensorFlow / Keras continues to honor HDF5 “external storage” and `ExternalLink` features when loading weights. A malicious `.weights.h5` (or a `.keras` archive embedding such weights) can direct `load_weights()` to read from an arbitrary readable filesystem path. The bytes pulled from that path populate model tensors and become observable through inference or subsequent re-save operations. Keras “safe mode” only guards object deserialization and does not cover weight I/O, so this behaviour persists even with safe mode enabled. The issue is confirmed on the latest publicly released stack (`tensorflow 2.20.0`, `keras 3.11.3`, `h5py 3.15.1`, `numpy 2.3.4`).
## Impact
- **Class**: CWE-200 (E
OSV
Keras has a Local File Disclosure via HDF5 External Storage During Keras Weight Loading
osv·2026-02-18
CVE-2026-1669 [HIGH] Keras has a Local File Disclosure via HDF5 External Storage During Keras Weight Loading
Keras has a Local File Disclosure via HDF5 External Storage During Keras Weight Loading
## Summary
TensorFlow / Keras continues to honor HDF5 “external storage” and `ExternalLink` features when loading weights. A malicious `.weights.h5` (or a `.keras` archive embedding such weights) can direct `load_weights()` to read from an arbitrary readable filesystem path. The bytes pulled from that path populate model tensors and become observable through inference or subsequent re-save operations. Keras “safe mode” only guards object deserialization and does not cover weight I/O, so this behaviour persists even with safe mode enabled. The issue is confirmed on the latest publicly released stack (`tensorflow 2.20.0`, `keras 3.11.3`, `h5py 3.15.1`, `numpy 2.3.4`).
## Impact
- **Class**: CWE-200 (E
OSV
Duplicate Advisory: Keras vulnerable to arbitrary file read in the model loading mechanism (HDF5 integration)
osv·2026-02-12
CVE-2026-1669 [HIGH] Duplicate Advisory: Keras vulnerable to arbitrary file read in the model loading mechanism (HDF5 integration)
Duplicate Advisory: Keras vulnerable to arbitrary file read in the model loading mechanism (HDF5 integration)
## Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-3m4q-jmj6-r34q. This link is maintained to preserve external references.
## Original Description
Arbitrary file read in the model loading mechanism (HDF5 integration) in Keras versions 3.0.0 through 3.13.1 on all supported platforms allows a remote attacker to read local files and disclose sensitive information via a crafted .keras model file utilizing HDF5 external dataset references.
OSV
CVE-2026-1669: Arbitrary file read in the model loading mechanism (HDF5 integration) in Keras versions 3
osv·2026-02-11·CVSS 7.1
CVE-2026-1669 [HIGH] CVE-2026-1669: Arbitrary file read in the model loading mechanism (HDF5 integration) in Keras versions 3
Arbitrary file read in the model loading mechanism (HDF5 integration) in Keras versions 3.0.0 through 3.13.1 on all supported platforms allows a remote attacker to read local files and disclose sensitive information via a crafted .keras model file utilizing HDF5 external dataset references.
Red Hat
keras: Keras: Information disclosure via malicious model archive with Virtual Dataset
vendor_redhat·2026-07-01·CVSS 5.5
CVE-2026-12480 [MEDIUM] CWE-22 keras: Keras: Information disclosure via malicious model archive with Virtual Dataset
keras: Keras: Information disclosure via malicious model archive with Virtual Dataset
Keras versions up to and including 3.13.2 are vulnerable to an arbitrary HDF5 file read due to an incomplete fix for CVE-2026-1669. The vulnerability resides in the `H5IOStore._verify_dataset()` and `file_editor.py` methods, which fail to check the `dataset.is_virtual` property of HDF5 datasets. This allows an attacker to craft a malicious `.keras` model archive or `.h5` weights file containing a Virtual Dataset (VDS) that references external HDF5 files on the victim's filesystem. When the victim loads the model using `keras.models.load_model()` or `keras.saving.load_model()`, the external file is transparently read, leading to potential information disclosure. Fixed in versions 3.12.2 and 3.14.1.
A fla
Red Hat
keras: Keras: Information disclosure via arbitrary file read in model loading mechanism
vendor_redhat·2026-02-11·CVSS 7.1
CVE-2026-1669 [HIGH] CWE-73 keras: Keras: Information disclosure via arbitrary file read in model loading mechanism
keras: Keras: Information disclosure via arbitrary file read in model loading mechanism
Arbitrary file read in the model loading mechanism (HDF5 integration) in Keras versions 3.0.0 through 3.13.1 on all supported platforms allows a remote attacker to read local files and disclose sensitive information via a crafted .keras model file utilizing HDF5 external dataset references.
A flaw was found in Keras. A remote attacker can exploit an arbitrary file read vulnerability in the model loading mechanism (HDF5 integration) by providing a specially crafted .keras model file that utilizes HDF5 external dataset references. This allows the attacker to read local files and disclose sensitive information.
Statement: This IMPORTANT flaw in Keras allows for arbitrary file read operations. Red Hat Op
Debian
CVE-2026-1669: keras - Arbitrary file read in the model loading mechanism (HDF5 integration) in Keras v...
vendor_debian·2026·CVSS 7.1
CVE-2026-1669 [HIGH] CVE-2026-1669: keras - Arbitrary file read in the model loading mechanism (HDF5 integration) in Keras v...
Arbitrary file read in the model loading mechanism (HDF5 integration) in Keras versions 3.0.0 through 3.13.1 on all supported platforms allows a remote attacker to read local files and disclose sensitive information via a crafted .keras model file utilizing HDF5 external dataset references.
Scope: local
bullseye: open
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-12480 keras: Keras: Information disclosure via malicious model archive with Virtual Dataset
bugzilla·2026-07-01·CVSS 5.5
CVE-2026-12480 [MEDIUM] CVE-2026-12480 keras: Keras: Information disclosure via malicious model archive with Virtual Dataset
CVE-2026-12480 keras: Keras: Information disclosure via malicious model archive with Virtual Dataset
Keras versions up to and including 3.13.2 are vulnerable to an arbitrary HDF5 file read due to an incomplete fix for CVE-2026-1669. The vulnerability resides in the `H5IOStore._verify_dataset()` and `file_editor.py` methods, which fail to check the `dataset.is_virtual` property of HDF5 datasets. This allows an attacker to craft a malicious `.keras` model archive or `.h5` weights file containing a Virtual Dataset (VDS) that references external HDF5 files on the victim's filesystem. When the victim loads the model using `keras.models.load_model()` or `keras.saving.load_model()`, the external file is transparently read, leading to potential information disclosure. Fixed in versions 3.12.2 and
Wiz
CVE-2026-1669 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.1
CVE-2026-1669 [HIGH] CVE-2026-1669 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-1669 :
Python vulnerability analysis and mitigation
Arbitrary file read in the model loading mechanism (HDF5 integration) in Keras versions 3.0.0 through 3.13.1 on all supported platforms allows a remote attacker to read local files and disclose sensitive information via a crafted .keras model file utilizing HDF5 external dataset references.
Source : NVD
## 7.1
Score
Published February 11, 2026
Severity HIGH
CNA Score 7.1
Affected Technologies
Python
Wolfi
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 2.4
Exploitation Probability (EPSS) N/A
Affected packages and libraries
tensorflow-cpu-jupyter
keras
Sources
NVD
Chainguard Has Fix Added at: Feb 20, 2026
Debian 11
2026-02-11
Published