CVE-2026-1669 Arbitrary File Read in Keras via HDF5 External Datasets
Attackers can read local files and disclose sensitive information by tricking users into loading a crafted Keras model file with malicious HDF5 references.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-1669?
CVE-2026-1669 is a high-severity path traversal vulnerability in Google Keras, published on 11 Feb 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Arbitrary file read in the model loading mechanism (HDF5 integration) in Keras versions 3.0.0 through 3.13.1 on all supported platforms allows a remote attacker to read local files and disclose sensitive information via a crafted .keras model file utilizing HDF5 external dataset references.
Which versions are affected by CVE-2026-1669?
5 open source packages ship an affected version, including keras. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
keras PyPI | From 3.0.0 | 3.12.1, 3.13.2 |
keras PyPI | From 3.0.0 | 3.12.1 |
keras PyPI | From 3.0.0 | 3.12.1 |
keras PyPI | From 3.13.0 | 3.13.2 |
keras PyPI | From 3.13.0 | 3.13.2 |
Products include Keras Keras.
How do I fix CVE-2026-1669?
Upgrade keras to a fixed version for your release line: 3.12.1 or 3.13.2.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-1669 being exploited?
There is no known exploitation of CVE-2026-1669 in the wild and no public exploit code.
Other vulnerabilities in Google Keras
- CVE-2024-3660 Arbitrary code injection vulnerability in Keras framework < 2.13
- CVE-2026-12481 Deserialization of Untrusted Data in keras-team/keras
- CVE-2026-1462 Safe Mode Bypass in keras-team/keras
- CVE-2025-9906 Arbitrary Code execution in Keras Safe Mode
- CVE-2025-8747 Keras safe_mode bypass allows arbitrary code execution when loading a malicious model.
Sources
Also known as AZL-77414, DEBIAN-CVE-2026-1669, GHSA-3m4q-jmj6-r34q, MINI-q9rp-q92v-7v3x, PYSEC-2026-2546, UBUNTU-CVE-2026-1669.