CVE-2026-9335: Keras HDF5 Information Disclosure Flaw

CVE-2026-9335 Overview

CVE-2026-9335 is an information disclosure vulnerability in keras-team/keras versions <= 3.14.0. The flaw allows attackers to read arbitrary local HDF5 file content through improper handling of HDF5 ExternalLink objects. The KerasFileEditor and keras.saving.load_weights functions bypass the safe_get_h5_group and safe_get_h5_dataset helpers designed to reject ExternalLink and SoftLink references. Attackers exploit this by supplying a malicious .h5, .weights.h5, or .keras file containing crafted external links. Loading the file causes automatic dereferencing to external HDF5 files on the victim's filesystem, exposing sensitive data. The vulnerability is classified as [CWE-22] Path Traversal.

Critical Impact
Arbitrary local file content disclosure via malicious Keras model files, exposing sensitive HDF5-formatted data on the victim's filesystem.

Affected Products

keras-team/keras versions <= 3.14.0
Applications using KerasFileEditor
Applications using keras.saving.load_weights with untrusted model files

Discovery Timeline

2026-08-02 - CVE-2026-9335 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-9335

Vulnerability Analysis

The vulnerability stems from inconsistent enforcement of link-type validation across Keras HDF5 loading code paths. Keras provides safe_get_h5_group and safe_get_h5_dataset helpers that reject h5py.ExternalLink and h5py.SoftLink objects to prevent unintended dereferencing. However, KerasFileEditor and keras.saving.load_weights access HDF5 groups directly without invoking these helpers. When h5py encounters an ExternalLink, it transparently opens the linked external file and returns its contents. An attacker who controls a model file distributed to a victim can therefore reference arbitrary HDF5 files on the victim's local filesystem. KerasFileEditor extracts attributes and datasets from the linked files into its internal structures. keras.saving.load_weights loads the linked weights directly into the user's model, where they can be exfiltrated.

Root Cause

The root cause is a missing guard against h5py.ExternalLink and h5py.SoftLink in the affected code paths. User-controlled .h5, .weights.h5, or .keras files can embed link objects that resolve to filesystem paths outside the model archive.

Attack Vector

An attacker crafts a malicious Keras model file containing HDF5 ExternalLink entries pointing to sensitive local files. The attacker distributes the file through model-sharing hubs, email, or supply chain channels. When a victim opens the file with KerasFileEditor or loads it via keras.saving.load_weights, h5py silently dereferences the links. The referenced file contents are pulled into the loaded model or editor state, where the attacker can retrieve them if the model is republished or its weights are later inspected.

python

            # IMPORTANT:
            # Never mutate inner_path; use local variable.
            current_inner_path = f"{inner_path}/{key}"
+
+            # Reject HDF5 `ExternalLink`/`SoftLink`.
+            child_class = data.get(
+                key, default=None, getclass=True, getlink=True
+            )
+            if child_class in (h5py.ExternalLink, h5py.SoftLink):
+                raise ValueError(
+                    f"Not allowed: H5 file with {child_class.__name__}"
+                )
+
            value = data[key]

Source: GitHub Keras Commit 23370f16. The patch inspects each child object with getclass=True, getlink=True and raises a ValueError when the child is an ExternalLink or SoftLink.

Detection Methods for CVE-2026-9335

Indicators of Compromise

Unexpected .h5, .weights.h5, or .keras files from untrusted sources being loaded on developer workstations or ML pipelines.
HDF5 files containing h5py.ExternalLink or h5py.SoftLink objects, which are unusual in legitimate model artifacts.
Model-loading processes making unexpected reads to paths outside the expected model directory.

Detection Strategies

Scan model files with h5py to enumerate group entries and flag any object whose class is ExternalLink or SoftLink before loading.
Monitor Python processes running Keras for file reads outside the intended model archive directory.
Inspect ML pipeline artifacts and model registries for HDF5 files containing link objects using automated pre-ingestion checks.

Monitoring Recommendations

Log all invocations of keras.saving.load_weights and KerasFileEditor in build systems and inference environments.
Alert on process file access telemetry showing Python interpreters reading sensitive files such as ~/.ssh/, .aws/credentials, or /etc/ when handling model files.
Track the installed version of the keras package across development environments to identify hosts running <= 3.14.0.

How to Mitigate CVE-2026-9335

Immediate Actions Required

Upgrade keras to a version above 3.14.0 that includes commit 23370f16b0ab9a200f7550a34e54a3ceab74ba0e.
Treat all .h5, .weights.h5, and .keras files from external sources as untrusted until scanned.
Audit shared model repositories for files containing HDF5 ExternalLink or SoftLink objects.

Patch Information

The fix is applied in keras/src/saving/file_editor.py via commit 23370f16b0ab9a200f7550a34e54a3ceab74ba0e. The patch inspects each HDF5 child with getlink=True and rejects ExternalLink and SoftLink objects with a ValueError. Details are also available in the Huntr Bug Bounty Report.

Workarounds

Pre-validate HDF5 files by iterating groups with h5py and rejecting any entry whose getclass=True, getlink=True result is h5py.ExternalLink or h5py.SoftLink.
Load untrusted model files only inside sandboxed environments with no access to sensitive filesystem paths.
Restrict Keras model loading to files originating from trusted internal registries with integrity verification.

bash

# Upgrade Keras to a patched release
pip install --upgrade 'keras>3.14.0'

# Quick pre-load screen for ExternalLink/SoftLink
python -c "import h5py, sys
f = h5py.File(sys.argv[1], 'r')
def check(name):
    obj = f.get(name, getclass=True, getlink=True)
    if obj in (h5py.ExternalLink, h5py.SoftLink):
        print('UNSAFE link at', name); sys.exit(1)
f.visit(check)
print('ok')" suspicious_model.h5