Is CVE-2026-1669 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-1669 being exploited in the wild.

How severe is CVE-2026-1669?

High severity, with a CVSS score of 7.5, published 11 February 2026.

Which products and versions are affected?

keras (PyPI) ECOSYSTEM:introduced=3.0.0,fixed=3.12.1,introduced=3.13.0,fixed=3.13.2, ECOSYSTEM:introduced=3.13.0,fixed=3.13.2.

Is there a fix for CVE-2026-1669?

Yes. keras (PyPI): upgrade to 3.13.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-1669 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-1669?

Check whether you run keras (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-1669: Google Keras arbitrary file read in HDF5 model loading

CVE-2026-1669 · Severity: high · CVSS 7.5 · Published 2026-02-11

Keras is a popular open-source library used for building and training artificial intelligence models. A security flaw in how it handles certain file formats allows an attacker to create a malicious AI model file that, when loaded, can read private files from the computer or server running the software. This could lead to the theft of sensitive configuration data, credentials, or other private information.

Technologies: keras (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-1669 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-1669 being exploited in the wild.
How severe is CVE-2026-1669?: High severity, with a CVSS score of 7.5, published 11 February 2026.
Which products and versions are affected?: keras (PyPI) ECOSYSTEM:introduced=3.0.0,fixed=3.12.1,introduced=3.13.0,fixed=3.13.2, ECOSYSTEM:introduced=3.13.0,fixed=3.13.2.
Is there a fix for CVE-2026-1669?: Yes. keras (PyPI): upgrade to 3.13.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-1669 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-1669?: Check whether you run keras (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

keras (PyPI): upgrade to 3.13.2 or later
```
pip install "keras>=3.13.2"
```

Technical details

An arbitrary file read vulnerability exists in the Keras model loading mechanism, specifically within its HDF5 integration. The root cause is the improper handling of HDF5 external dataset references, which allows a crafted '.keras' model file to point to and read arbitrary files on the local filesystem (CWE-73, CWE-200). An attacker can exploit this by providing a malicious model file to a system that uses Keras to load or process models. This vulnerability affects Keras versions 3.0.0 through 3.13.1 and has been identified in downstream products like Red Hat OpenShift AI. Red Hat has classified the impact as 'Important'.

Affected products

Google Keras 3.0.0 through 3.13.1
Red Hat OpenShift AI (RHOAI)

Identifiers

CVE-2026-1669
GHSA-3m4q-jmj6-r34q
PYSEC-2026-2546

Timeline

2026-02-11: disclosed: Initial disclosure by Google Inc.
2026-02-11: advisory: NVD published the CVE record.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.