Executive brief
Keras is a popular open-source library used for building and training artificial intelligence models. A security flaw in how it handles certain file formats allows an attacker to create a malicious AI model file that, when loaded, can read private files from the computer or server running the software. This could lead to the theft of sensitive configuration data, credentials, or other private information.
Technical details
An arbitrary file read vulnerability exists in the Keras model loading mechanism, specifically within its HDF5 integration. The root cause is the improper handling of HDF5 external dataset references, which allows a crafted '.keras' model file to point to and read arbitrary files on the local filesystem (CWE-73, CWE-200). An attacker can exploit this by providing a malicious model file to a system that uses Keras to load or process models. This vulnerability affects Keras versions 3.0.0 through 3.13.1 and has been identified in downstream products like Red Hat OpenShift AI. Red Hat has classified the impact as 'Important'.
Affected products
- Google Keras 3.0.0 through 3.13.1
- Red Hat OpenShift AI (RHOAI)
Timeline
- 2026-02-11: disclosed: Initial disclosure by Google Inc.
- 2026-02-11: advisory: NVD published the CVE record.