CVE-2026-1669: Keras Information Disclosure Vulnerability

CVE-2026-1669 Overview

CVE-2026-1669 is an arbitrary file read vulnerability in the Keras deep learning library. The flaw resides in the model loading mechanism that integrates with the Hierarchical Data Format version 5 (HDF5). Keras versions 3.0.0 through 3.13.1 process external dataset references inside .keras model files without adequate path restrictions. A remote attacker can craft a malicious model file that, when loaded by a victim, reads arbitrary local files and discloses sensitive information. The weakness is classified under [CWE-73] External Control of File Name or Path.

Critical Impact
Loading an attacker-supplied .keras model file can leak credentials, private keys, training data, or other sensitive files accessible to the Python process.

Affected Products

Keras 3.0.0 through 3.13.1
Python machine learning pipelines that deserialize untrusted .keras models
Downstream applications and notebooks integrating Keras 3 with HDF5 backends

Discovery Timeline

2026-02-11 - CVE-2026-1669 published to the National Vulnerability Database
2026-02-26 - Last updated in NVD database

Technical Details for CVE-2026-1669

Vulnerability Analysis

The vulnerability stems from how Keras 3 deserializes model archives that embed HDF5 weight stores. HDF5 supports external dataset references, allowing a dataset to point at a file outside the archive. When Keras loads such a model, the HDF5 layer resolves the external reference and reads the target file from disk. The library does not validate or sandbox these paths against the model archive boundary.

An attacker controls the referenced path inside the crafted .keras file. During keras.models.load_model(), the HDF5 reader transparently opens the referenced file and exposes its contents through dataset attributes that the model loader can read back. The result is server-side or client-side file disclosure under the privileges of the Python process performing the load.

Root Cause

The root cause is missing path validation on HDF5 external dataset references during model loading. Keras trusts the file metadata embedded in the model archive and delegates resolution to the HDF5 library without enforcing a chroot, allowlist, or archive-relative path policy. This matches the pattern described by [CWE-73], where external input controls a file path used by privileged code.

Attack Vector

Exploitation requires the victim to load an attacker-supplied .keras file. Common delivery channels include public model hubs, shared notebooks, MLOps pipelines that fetch models from object storage, and CI jobs that evaluate user-submitted artifacts. User interaction is required, but no authentication or elevated privileges are needed on the target. The attacker reads any file path the Python process can access, such as /etc/passwd, cloud credential files in ~/.aws/, SSH keys, or proprietary training datasets. No verified public proof-of-concept code is available; see the GitHub Security Advisories for technical references.

Detection Methods for CVE-2026-1669

Indicators of Compromise

.keras archives containing HDF5 datasets with external file references pointing outside the archive root
Unexpected file open events on sensitive paths such as /etc/shadow, ~/.aws/credentials, or id_rsa originating from a Python interpreter running Keras
Network retrieval of .keras files from untrusted hosts immediately preceding anomalous file reads
Process telemetry showing python or jupyter reading files unrelated to declared training data

Detection Strategies

Inspect .keras archives statically and enumerate HDF5 external links using h5py before loading
Hunt for Python processes reading sensitive system files shortly after load_model invocations
Correlate model file downloads with subsequent unusual file access in EDR or audit logs
Flag Keras versions in the vulnerable range 3.0.0 through 3.13.1 across developer endpoints and build agents

Monitoring Recommendations

Enable file integrity and access auditing on credential stores, SSH keys, and dataset directories
Log all keras.models.load_model and tf.keras.models.load_model calls in production inference services
Forward Python application logs and host telemetry to a centralized analytics platform for correlation
Alert on outbound exfiltration following model load events from training and inference workloads

How to Mitigate CVE-2026-1669

Immediate Actions Required

Upgrade Keras to a fixed version beyond 3.13.1 once the vendor publishes a patched release
Treat all third-party .keras files as untrusted input and load them only inside isolated sandboxes
Rotate any credentials, tokens, or keys that may have been accessible to processes that loaded untrusted models
Inventory pipelines, notebooks, and services that call load_model on externally sourced artifacts

Patch Information

Review the GitHub Security Advisories for the official Keras fix and upgrade path. Until a patched release is deployed, restrict model loading to artifacts produced internally and verified by checksum.

Workarounds

Run model loading inside a container or sandbox with a minimal filesystem view and no access to secrets
Pre-scan .keras files with h5py and reject archives containing external HDF5 links
Execute inference workloads under a dedicated low-privilege service account with strict filesystem ACLs
Block egress from model-loading hosts to prevent exfiltration if a malicious model is processed

bash

# Configuration example: pre-scan a .keras archive for HDF5 external links
python - <<'EOF'
import zipfile, h5py, sys
path = sys.argv[1]
with zipfile.ZipFile(path) as z:
    z.extractall('/tmp/keras_scan')
with h5py.File('/tmp/keras_scan/model.weights.h5', 'r') as f:
    def visit(name, obj):
        if isinstance(obj, h5py.ExternalLink) or getattr(obj, 'file', None) and obj.file.filename != f.filename:
            print('External reference detected:', name)
    f.visititems(visit)
EOF