Executive brief
A security flaw has been identified in Keras, a widely used artificial intelligence library. This vulnerability allows a malicious actor to hide harmful code inside a machine learning model file. If a user loads this file, the hidden code will automatically run on their computer, potentially allowing the attacker to steal data or take control of the system, even if the user has enabled security protections like 'safe mode'.
Technical details
A deserialization vulnerability exists in the `TFSMLayer` class of the Keras package (specifically version 3.13.0). The root cause is the unconditional loading of external TensorFlow SavedModels during the deserialization of `.keras` files, which bypasses the `safe_mode=True` security setting. The `from_config()` method fails to validate attacker-controlled file paths, allowing the execution of arbitrary code embedded within a malicious SavedModel during inference. Attackers can exploit this by tricking a user into loading a crafted model file. The issue has been addressed in Keras version 3.13.2 by implementing safe mode checks in the `TFSMLayer.from_config()` method.
Affected products
- Keras Team Keras 3.13.0, < 3.13.2
- Red Hat OpenShift AI 2.25
Timeline
- 2026-04-13: disclosed
- 2026-04-13: advisory: NVD and Red Hat published advisories
- 2026-06-10: patched: Red Hat released fixed images for OpenShift AI 2.25.7
References
- https://github.com/keras-team/keras/commit/b6773d3decaef1b05d8e794458e148cb362f163f
- https://huntr.com/bounties/7e78d6f1-6977-4300-b595-e81bdbda331c
- https://access.redhat.com/errata/RHSA-2026:24977
- https://access.redhat.com/security/cve/CVE-2026-1462
- https://bugzilla.redhat.com/show_bug.cgi?id=2457856
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-1462.json