CVE-2026-1669: 
Python vulnerability analysis and mitigation

CVE-2026-1669 is an arbitrary file read vulnerability ("Local File Disclosure via HDF5 External Storage") in the Keras model loading mechanism's HDF5 integration. It affects Keras versions 3.0.0 through 3.13.1 (specifically patched in 3.12.1 and 3.13.2) on all supported platforms. A remote attacker can read arbitrary local files and disclose sensitive information by supplying a crafted .keras or .weights.h5 model file that leverages HDF5 external dataset references. The vulnerability was published on February 11, 2026, with the canonical GitHub advisory (GHSA-3m4q-jmj6-r34q) published February 17–18, 2026. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 7.1 (High) (Red Hat Advisory, GitHub Advisory).

The root cause is classified under CWE-73 (External Control of File Name or Path) and CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). Keras's HDF5 weight-loading code — invoked via model.load_weights() or tf.keras.models.load_model() — honors HDF5 "external storage" and ExternalLink features without restriction, allowing an attacker-controlled HDF5 file to redirect dataset reads to arbitrary host filesystem paths. When the victim loads the malicious file, the HDF5 library opens and streams bytes from the targeted file (e.g., /etc/passwd, /home/user/.ssh/id_rsa) directly into model tensors. Critically, Keras's "safe mode" (safe_mode=True) does not mitigate this attack because it only guards object/lambda deserialization, not weight I/O. A detailed proof-of-concept script and syscall traces confirming exploitation were published in the GitHub advisory (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation results in high confidentiality impact: an attacker can read the contents of any file readable by the process running Keras/TensorFlow, including sensitive files such as /etc/passwd, /etc/shadow, SSH private keys, API key configuration files, and other secrets. The leaked bytes are embedded into model tensors and become observable through inference outputs or by re-saving the model — meaning secrets can be exfiltrated without direct filesystem access if the victim shares or uploads the re-saved artifact. There is no direct availability or integrity impact to the host system, though the integrity of model artifacts is affected as they may contain embedded sensitive data (GitHub Advisory).

A working proof-of-concept script (weights_external_demo.py) was publicly disclosed as part of the GitHub advisory, demonstrating successful file exfiltration via model inference and re-saved weight artifacts. The attack requires the victim to load an attacker-supplied HDF5 weights file or .keras archive — a realistic scenario in ML pipelines that consume pre-trained models from public repositories, CI automation, or third-party contributors. No authentication or special privileges are required on the attacker's side; only passive user interaction (the victim loading the model) is needed. The EPSS score is approximately 0.014% (3rd percentile), and there is no current listing in the CISA KEV catalog. No threat actor attribution or in-the-wild exploitation has been reported (GitHub Advisory, Red Hat Advisory).

1. Craft a malicious HDF5 weights file: Using h5py, create or modify a .weights.h5 file so that one or more weight datasets (e.g., a Dense layer's bias) use HDF5 external storage pointing to a sensitive host file (e.g., /etc/passwd, /home/user/.ssh/id_rsa). This can be done by deleting the original dataset and recreating it with parent.create_dataset(..., external=[(host_file_path, 0, nbytes)]).
2. Optionally embed in a .keras archive: Package the malicious weights file inside a .keras archive to target users of tf.keras.models.load_model().
3. Deliver the payload: Distribute the crafted model file via a public model repository (e.g., Hugging Face Hub), an open-source contribution, a CI/CD artifact, or a direct file share — convincing the victim to use it as a pre-trained model.
4. Victim loads the model: The victim calls model.load_weights('malicious.weights.h5') or tf.keras.models.load_model('malicious.keras'). The HDF5 library follows the external reference, opens the targeted host file, and streams its bytes into model tensors.
5. Exfiltrate the data: Run inference on the loaded model with controlled inputs (e.g., zero vectors); the output contains the raw bytes of the targeted file. Alternatively, the victim may re-save the model, embedding the leaked bytes into a new artifact that can be retrieved by the attacker from a public registry or repository (GitHub Advisory).

• File System: Presence of unexpected .weights.h5 or .keras files with anomalous HDF5 structure (external dataset references detectable via h5py inspection: h5py.File(...).visititems() revealing datasets with get_external_count() > 0 or ExternalLink objects).
• File System: Re-saved model weight files (e.g., weights_demo_resaved.h5) containing binary content matching sensitive host files (e.g., /etc/passwd content embedded in float32 tensors).
• Process/Syscall: Unusual openat/open and read syscalls from the Python/TensorFlow process targeting sensitive files such as /etc/passwd, /etc/shadow, /etc/hostname, /home/*/.ssh/id_rsa, or application configuration files — detectable via strace or auditd rules.
• Logs: Auditd or eBPF-based file access logs showing the Keras/TensorFlow process reading files outside the expected model directory during a load_weights() or load_model() call.
• Network: Unexpected upload of model artifacts to external repositories or model registries shortly after a model load operation, potentially indicating exfiltration via re-saved artifacts (GitHub Advisory).

Keras has released patched versions 3.12.1 and 3.13.2, which default-deny HDF5 external datasets and external links during weight loading. Users should upgrade immediately using pip install 'keras>=3.12.1' (for the 3.12.x line) or pip install 'keras>=3.13.2' (for the 3.13.x line). As a workaround prior to patching, avoid loading HDF5 weight files from untrusted sources; pre-scan weight files using h5py to detect external datasets or links before invoking Keras loaders; prefer alternative formats such as NumPy .npz that lack external reference capabilities; and if isolation is unavoidable, run model loading inside a sandboxed environment with restricted filesystem access. Note that enabling Keras safe_mode=True does not mitigate this vulnerability (GitHub Advisory, Red Hat Advisory).

The vulnerability was reported by researcher N3mes1s and published through the keras-team/keras GitHub repository by hertschuh on February 17, 2026. Red Hat assigned the bug high priority/severity in their Bugzilla tracker. A community security digest (dev.to "Week in Security: Feb 17–23, 2026") highlighted the issue as notable for ML/AI supply chain security. The initial duplicate advisory (GHSA-gfmx-qqqh-f38q) was withdrawn on February 18, 2026, in favor of the canonical GHSA-3m4q-jmj6-r34q (GitHub Advisory, Red Hat Bugzilla).