CVE-2026-1669: Keras Arbitrary File Read Vulnerability in HDF5 Integration
Summary
CVE-2026-1669: Keras vulnerable to arbitrary file read in the model loading mechanism (HDF5 integration). Affects keras versions >= 3.0.0, <= 3.13.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Keras is an open-source deep learning framework that simplifies the process of building and training neural networks. It is widely used for its user-friendly API and flexibility, allowing developers to create complex models with ease. However, versions 3.0.0 through 3.13.1 of Keras contain a vulnerability in the model loading mechanism, specifically related to HDF5 integration, which can lead to unauthorized access to local files.
Vulnerability Detail
The vulnerability arises from the model loading mechanism in Keras that utilizes HDF5 external dataset references. This flaw allows a remote attacker to craft a malicious .keras model file that, when loaded, can read local files on the system where Keras is running. The potential ramifications include the disclosure of sensitive information, which could lead to further exploitation or data breaches. The vulnerability is classified under CWE-73, indicating improper access control.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid loading .keras model files from untrusted sources. Implement strict validation checks on model files before loading them into your application.
Conclusion
The Keras vulnerability identified as CVE-2026-1669 poses a significant risk due to its potential for arbitrary file read through HDF5 integration. Users are strongly advised to update to a patched version of Keras and to implement best practices for file handling to mitigate risks.
See every vulnerability recorded for keras →
FAQ
The CVSS score of this vulnerability is 7.1, indicating a high severity level.
Keras versions 3.0.0 through 3.13.1 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If you cannot update Keras immediately, ensure that you do not load model files from untrusted sources and implement validation checks.
Vulert monitors and alerts in real-time for open-source vulnerabilities in your software using just the Pipfile.lock. It helps you stay informed about potential vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for keras.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
