CVE-2026-12480: Keras HDF5 File Read Vulnerability

CVE-2026-12480 Overview

CVE-2026-12480 is an arbitrary file read vulnerability in Keras versions up to and including 3.13.2. The flaw exists because the H5IOStore._verify_dataset() and file_editor.py methods fail to check the dataset.is_virtual property of HDF5 datasets. An attacker can craft a malicious .keras model archive or .h5 weights file containing a Virtual Dataset (VDS) referencing external HDF5 files on the victim's filesystem. Loading the model with keras.models.load_model() or keras.saving.load_model() triggers transparent reads of the referenced external files. This is an incomplete-fix follow-up to CVE-2026-1669 and is tracked under [CWE-73] (External Control of File Name or Path).

Critical Impact
A crafted Keras model can silently read arbitrary HDF5 files from the victim's filesystem during model loading, leading to information disclosure.

Affected Products

Keras versions up to and including 3.13.2
Keras 3.12.x prior to 3.12.2
Keras 3.14.x prior to 3.14.1

Discovery Timeline

2026-07-01 - CVE CVE-2026-12480 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-12480

Vulnerability Analysis

The vulnerability stems from incomplete input validation in Keras's HDF5 loading code paths. HDF5 supports a feature called Virtual Datasets (VDS) that allows a dataset to reference data stored in external HDF5 files. When Keras validates datasets contained in a loaded model, it inspects dataset metadata but does not check whether a dataset is virtual. As a result, opening a virtual dataset transparently opens and reads the mapped external file on the local filesystem.

An attacker distributes a malicious .keras archive or .h5 weights file containing VDS entries pointing to sensitive paths such as configuration files, private keys, or other model artifacts on the victim host. When a data scientist or CI pipeline calls keras.models.load_model() or keras.saving.load_model(), the referenced files are read into memory as tensor data and can be exfiltrated if the loaded model is later serialized, logged, or transmitted.

Root Cause

The root cause is missing verification of the dataset.is_virtual property inside H5IOStore._verify_dataset() and keras/src/saving/file_editor.py. The original patch for CVE-2026-1669 addressed related HDF5 abuse paths but did not cover the virtual dataset code path, leaving the file-reference channel exposed.

Attack Vector

Exploitation requires local access to the victim's environment and user interaction, as the victim must load the attacker-supplied model file. Common delivery channels include model hubs, shared repositories, supply-chain compromise of ML pipelines, and email attachments targeting ML engineers.

python

# Patch snippet: keras/src/saving/file_editor.py
 import pprint
 import zipfile
 
-import h5py
 import numpy as np
 import rich.console

Source: GitHub Keras Commit d5a88bd

The upstream patch refactors and shares H5 validation code between the legacy and new formats so that virtual dataset checks are consistently enforced across both loading paths.

Detection Methods for CVE-2026-12480

Indicators of Compromise

Unexpected .keras or .h5 files sourced from untrusted origins present in developer workstations, notebooks, or CI runners.
HDF5 files that contain Virtual Dataset (VDS) entries referencing absolute paths outside the model archive.
Model loading processes performing file opens against paths such as /etc/, ~/.ssh/, or cloud credential directories.

Detection Strategies

Statically scan HDF5 model files with h5dump -p or h5py to enumerate datasets and flag any whose is_virtual attribute is true.
Instrument Python model-loading workflows to log all filesystem reads occurring during load_model() calls and alert on reads outside the archive directory.
Inventory installed Keras versions across developer endpoints and build agents; flag any version at or below 3.13.2 that is not 3.12.2 or 3.14.1.

Monitoring Recommendations

Monitor Python interpreter processes for unusual open() syscalls following load_model() invocations, especially reads of credentials or SSH keys.
Track network egress from ML training and inference hosts for anomalous outbound transfers immediately after model loading.
Review artifact registries and model hubs for newly uploaded models that fail VDS validation checks.

How to Mitigate CVE-2026-12480

Immediate Actions Required

Upgrade Keras to version 3.12.2 or 3.14.1, which contain the complete fix for the virtual dataset check.
Audit existing .keras and .h5 files in shared storage, model registries, and CI caches for VDS references to external paths.
Restrict model loading to files originating from trusted, signed sources and disable automatic loading of user-supplied models in interactive notebooks.

Patch Information

The fix is committed in GitHub Keras Commit d5a88bd and released in Keras 3.12.2 and 3.14.1. The patch refactors HDF5 validation so that both H5IOStore._verify_dataset() and file_editor.py reject virtual datasets. Additional context is available in the Huntr Bug Bounty Report.

Workarounds

Pre-validate untrusted model files by opening them with h5py and rejecting any dataset where dataset.is_virtual evaluates to true before passing them to Keras.
Execute model loading inside a sandbox or container with a read-only, minimal filesystem so that VDS references cannot reach sensitive host files.
Run ML pipelines under a low-privilege service account that has no access to secrets, SSH keys, or cloud credential files.

bash

# Upgrade Keras to a patched version
pip install --upgrade 'keras>=3.14.1'

# Or, for the 3.12.x branch
pip install --upgrade 'keras==3.12.2'

# Quick pre-load check for virtual datasets
python -c "import h5py, sys; f=h5py.File(sys.argv[1],'r'); f.visititems(lambda n,o: print('VDS:',n) if isinstance(o,h5py.Dataset) and o.is_virtual else None)" suspect_model.h5