CVE-2026-1669
Fixed in a distro release EPSS <1%CVSS 7.1
Arbitrary file read in the model loading mechanism (HDF5 integration) in Keras versions 3.0.0 through 3.13.1 on all supported platforms allows a remote attacker to read local files and disclose sensitive information via a crafted .keras model file utilizing HDF5 external dataset references.
Products: Google Keras, Red Hat OpenShift AI (RHOAI)
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | keras | 3.13.2 |
| PyPI | keras | 3.12.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | tensorflow-cpu-jupyter | 2.20.0-r11 |
| Chainguard | tensorflow-gpu-jupyter | 2.20.0-r10 |
| Debian 11 | keras | no fix |
| Ubuntu 18.04 LTS | keras | no fix |
| Ubuntu 20.04 LTS | keras | no fix |