Which versions of Keras are affected by CVE-2026-1669?

Keras machine learning framework (versions 3.0.0-3.13.1) contains a file-disclosure vulnerability that could expose sensitive organizational assets such as credentials and intellectual property when…. A patch is available.

How to fix or mitigate CVE-2026-1669?

Within 24 hours: Identify all systems running Keras 3.0.0-3.13.1 and document model-loading use cases; restrict untrusted file transfer sources where applicable. Within 7 days: Apply the vendor-released Keras patch to all affected installations per advisory guidance. Within 30 days: Audit system logs for suspicious .keras model loading activity; implement controls to block untrusted model sources.

Keras CVE-2026-1669

Q: What is the CVSS score of CVE-2026-1669?

CVE-2026-1669 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

HIGH

External Control of File Name or Path (CWE-73)

2026-02-11 cve-coordination@google.com

GHSA-3m4q-jmj6-r34q

Information Disclosure Keras

7.1

CVSS 4.0 · Vendor: google

Severity by source

Vendor (google) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Remotely delivered malicious model but requires the user to load it (UI:R); unauthenticated (PR:N); pure file-read disclosure so C:H, I:N, A:N.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Red Hat

6.5 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Updated

Jun 30, 2026 - 05:44 vuln.today

v7 (cvss_changed)

Analysis Updated

Jun 30, 2026 - 05:44 vuln.today

v6 (cvss_changed)

Analysis Updated

Jun 30, 2026 - 05:43 vuln.today

v5 (cvss_changed)

Analysis Updated

Jun 30, 2026 - 05:43 vuln.today

v4 (cvss_changed)

Analysis Updated

Jun 30, 2026 - 05:42 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 30, 2026 - 05:42 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 30, 2026 - 03:23 vuln.today

cvss_changed

CVSS changed

Jun 30, 2026 - 03:23 NVD

7.5 (HIGH) 7.1 (HIGH)

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 11, 2026 - 23:16 nvd

HIGH 7.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 pypi packages depend on keras (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 3.13.0.

DescriptionCVE.org

Arbitrary file read in the model loading mechanism (HDF5 integration) in Keras versions 3.0.0 through 3.13.1 on all supported platforms allows a remote attacker to read local files and disclose sensitive information via a crafted .keras model file utilizing HDF5 external dataset references.

AnalysisAI

Arbitrary local file disclosure in Keras 3.0.0 through 3.13.1 allows a remote attacker to read sensitive files from a victim's system by tricking them into loading a malicious .keras model that abuses HDF5 external dataset references in the model-loading path. Exploitation requires the victim to open the attacker-supplied model (UI:P), but no authentication is needed; EPSS is very low (0.01%, 2nd percentile) and there is no public exploit identified at time of analysis. A vendor patch is available.

Technical ContextAI

Keras is a widely used high-level deep-learning API (the default front end for TensorFlow and usable with JAX/PyTorch). The .keras model format is a zip archive that can embed weights stored via HDF5 (the .h5/HDF5 hierarchical data format handled through h5py/libhdf5). HDF5 supports 'external dataset' references, where a dataset's raw bytes are stored in a separate file path declared inside the container; when Keras loads such a model it follows these references, and a crafted file can point them at arbitrary local paths so their contents are read back into the deserialized model. The root cause maps to CWE-73 (External Control of File Name or Path): the model loader trusts file/path references supplied inside untrusted model data instead of constraining reads to the archive.

RemediationAI

Upgrade Keras to a fixed release above 3.13.1 (Patch available per vendor advisory; the exact patched version is not stated in the provided data, so confirm the precise fixed version via the Google security-research advisory at https://github.com/google/security-research/security/advisories and the Red Hat tracker at https://access.redhat.com/security/cve/CVE-2026-1669 before deploying). Until patched, the most effective compensating control is to never load .keras/HDF5 models from untrusted or unverified sources and to treat shared model files as untrusted input; load suspect models only inside a sandboxed, network- and filesystem-isolated environment (e.g., a container with no access to sensitive paths) so any external dataset reference resolves to nothing of value, accepting the trade-off of added workflow friction. Where feasible, inspect/validate model archives for HDF5 external dataset references before loading and prefer the safe-loading paths recommended by the vendor advisory.