Read the docs
TI-2026-10714 Aliases CVE-2026-12480GHSA-26c4-7vv6-867j

Arbitrary HDF5 File Read via Virtual Dataset Bypass in keras-team/keras

Priority MEDIUM 58CWE-73Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-73 and the CVSS impact.

Summary

Keras versions up to and including 3.13.2 are vulnerable to an arbitrary HDF5 file read due to an incomplete fix for CVE-2026-1669. The vulnerability resides in the `H5IOStore._verify_dataset()` and `file_editor.py` methods, which fail to check the `dataset.is_virtual` property of HDF5 datasets. This allows an attacker to craft a malicious `.keras` model archive or `.h5` weights file containing a Virtual Dataset (VDS) that references external HDF5 files on the victim's filesystem. When the victim loads the model using `keras.models.load_model()` or `keras.saving.load_model()`, the external file is transparently read, leading to potential information disclosure. Fixed in versions 3.12.2 and 3.14.1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0019 8th percentileScored 2026-11-07
Fix Partial keras-team/keras (keras-team): 3.12.2, 3.14.1keras (PyPI): 3.12.3, 3.15.0Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
keras-teamkeras-team/kerasbefore 3.12.2, 3.14.13.12.2, 3.14.1Patch availableCNA
—keras (PyPI)before 3.12.33.12.3Patch availableGHSA-26c4-7vv6-867j
—keras (PyPI)3.13.0 to before 3.15.03.15.0Patch availableGHSA-26c4-7vv6-867j
  • keras-team/keras Vendorkeras-team Affected before 3.12.2, 3.14.1 Fixed in 3.12.2, 3.14.1 Patch available CNA
  • keras (PyPI) Vendor— Affected before 3.12.3 Fixed in 3.12.3 Patch available GHSA-26c4-7vv6-867j
  • keras (PyPI) Vendor— Affected 3.13.0 to before 3.15.0 Fixed in 3.15.0 Patch available GHSA-26c4-7vv6-867j

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:keras:keras:*:*:*:*:*:*:*:*——keras-team
  • cpe:2.3:a:keras:keras:*:*:*:*:*:*:*:* Versions — — ·keras-team

Remediation

  • Fix · CNA keras-team/keras (keras-team) Fixed in 3.12.2, 3.14.1
  • Fix · GHSA-26c4-7vv6-867j keras (PyPI) Fixed in 3.12.3 Advisory →
  • Fix · GHSA-26c4-7vv6-867j keras (PyPI) Fixed in 3.15.0 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet: Fix deferred

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-12480
  2. 2026-10-03 Alias added: GHSA-26c4-7vv6-867j

References

Advisory 1

Other 6

  • TI-2025-31626 Deserialization of untrusted data in keras-team Keras CVSS 3.1CRITICAL 9.8
  • TI-2026-10715 Deserialization of Untrusted Data in keras-team/keras CVSS 3.1CRITICAL 9.8
  • TI-2026-01159 Safe Mode Bypass in keras-team/keras CVSS 3.0HIGH 8.8
  • TI-2025-08001 Keras safe_mode bypass allows arbitrary code execution when loading a malicious model. CVSS 4.0HIGH 8.6
  • TI-2026-10199 Path Traversal in keras-team/keras CVSS 3.0HIGH 8.1
  • TI-2025-11591 Path Traversal Vulnerability in keras-team/keras via Tar Archive Extraction in keras.utils.get_file() CVSS 3.0HIGH 8.0
See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences