CVE-2026-1669
High · 7.5CVSS
7.5
EPSS
0.3%
Published
Feb 11, 2026
CISA due date
—
The record
Arbitrary file read in the model loading mechanism (HDF5 integration) in Keras versions 3.0.0 through 3.13.1 on all supported platforms allows a remote attacker to read local files and disclose sensitive information via a crafted .keras model file utilizing HDF5 external dataset references.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | keras | 3.0.0 | 3.12.1 |
| PyPI | keras | 3.0.0 | No fix |
| PyPI | keras | 3.13.0 | 3.13.2 |
| Chainguard | tensorflow-cpu-jupyter | 0 | 2.20.0-r11 |
| Chainguard | tensorflow-gpu-jupyter | 0 | 2.20.0-r10 |
| Wolfi | tensorflow-cpu-jupyter | 0 | 2.20.0-r11 |
Related vulnerabilities
- CVE-2026-0897 Google Keras Allocates Resources Without Limits or Throttling in the HDF5 weight loading… Also affects keras
- GHSA-9g7v-8wxv-mwxp Duplicate Advisory: Keras keras.utils.get_file API is vulnerable to a path traversal… Also affects keras
- CVE-2025-12638 Keras version 3.11.3 is affected by a path traversal vulnerability in the… Also affects keras
- CVE-2025-12060 The keras.utils.get_file API in Keras, when used with the extract=True option for tar… Also affects keras
- CVE-2025-12058 The Keras.Model.load_model method, including when executed with the intended security… Also affects keras
- CVE-2024-55459 keras Path Traversal vulnerability Also affects keras
- CVE-2024-3660 A arbitrary code injection vulnerability in TensorFlow's Keras framework (<2.13) allows… Also affects keras
- CVE-2026-31958 Tornado is a Python web framework and asynchronous networking library. Also affects tensorflow-cpu-jupyter