Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-07-01T16:53:32 keras: Keras: Information disclosure via malicious model archive with Virtual Dataset 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CWE-22

Keras versions up to and including 3.13.2 are vulnerable to an arbitrary HDF5 file read due to an incomplete fix for CVE-2026-1669. The vulnerability resides in the `H5IOStore._verify_dataset()` and `file_editor.py` methods, which fail to check the `dataset.is_virtual` property of HDF5 datasets. This allows an attacker to craft a malicious `.keras` model archive or `.h5` weights file containing a Virtual Dataset (VDS) that references external HDF5 files on the victim's filesystem. When the victim loads the model using `keras.models.load_model()` or `keras.saving.load_model()`, the external file is transparently read, leading to potential information disclosure. Fixed in versions 3.12.2 and 3.14.1.

A flaw was found in Keras. An attacker can craft a malicious model archive or weights file containing a Virtual Dataset (VDS) that references external files on a victim's system. When a user loads this malicious model, the external file is transparently read. This vulnerability leads to information disclosure, allowing an attacker to access sensitive data from the victim's filesystem.

Moderate: This information disclosure flaw in Keras affects Red Hat OpenShift AI components that utilize Keras. The vulnerability allows an attacker to read arbitrary files on the victim's system if a malicious Keras model archive or weights file containing a Virtual Dataset (VDS) is loaded. Exploitation requires user interaction, specifically loading an untrusted model, which limits the attack vector to scenarios where users process external, potentially malicious, model files. Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-kserve-agent-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-kserve-controller-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-kserve-router-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-kserve-storage-initializer-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-modelmesh-runtime-adapter-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-12480 https://nvd.nist.gov/vuln/detail/CVE-2026-12480 https://github.com/keras-team/keras/commit/d5a88bdb137c0d3039b8f4bbbe8c7099925cc10c https://huntr.com/bounties/1875d257-5b03-4a69-ac70-e98653fa12c7