CVE-2026-9335 in Keras
Summary
by MITRE • 08/02/2026
A vulnerability in keras-team/keras versions <= 3.14.0 allows arbitrary local HDF5 file content disclosure due to improper handling of HDF5 ExternalLinks. The `KerasFileEditor` and `keras.saving.load_weights` functions bypass the `safe_get_h5_group` and `safe_get_h5_dataset` helpers, which are designed to reject ExternalLinks and SoftLinks. This results in automatic dereferencing of links to external HDF5 files, enabling attackers to disclose sensitive data from the victim's local filesystem. Specifically, `KerasFileEditor` extracts attributes and datasets from linked files into its internal structures, while `keras.saving.load_weights` loads weights from linked files into the user's model. This issue can be exploited by providing a malicious `.h5`, `.weights.h5`, or `.keras` file containing ExternalLinks.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/03/2026
This vulnerability exists within the keras deep learning framework where versions up to and including 3.14.0 fail to properly validate HDF5 file structures when processing model files. The core issue stems from inadequate handling of external symbolic links within the HDF5 format, specifically ExternalLinks that point to files outside the intended scope. When attackers craft malicious model files containing these links, the framework's loading mechanisms bypass essential safety checks designed to prevent unauthorized access to system resources.
The technical flaw manifests in two primary functions within the keras codebase: KerasFileEditor and keras.saving.load_weights. These components directly access HDF5 file contents without utilizing the protective safe_get_h5_group and safe_get_h5_dataset helper functions that were specifically implemented to reject ExternalLinks and SoftLinks. This design oversight creates a path where external file references are automatically resolved, allowing attackers to chain together multiple files and extract arbitrary content from the local filesystem. The vulnerability operates at the file system level rather than network level, making it particularly dangerous in environments where model files might be processed from untrusted sources.
The operational impact of this vulnerability extends beyond simple information disclosure, as it can enable attackers to access sensitive data including configuration files, credentials, or other model artifacts stored on the same system. When KerasFileEditor processes malicious files, it incorporates attributes and datasets from linked external HDF5 files into its internal structures, effectively merging unauthorized content with legitimate model data. Similarly, keras.saving.load_weights function loads weights from these external sources directly into user models, potentially enabling more sophisticated attacks including model poisoning or data exfiltration through carefully crafted link chains. This represents a critical security gap that violates the principle of least privilege in file system access.
The vulnerability aligns with CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and CWE-345 (Insufficient Verification of Data Authenticity), as it fails to properly validate file references and does not verify the authenticity or safety of external links. From an attacker's perspective, this maps to techniques described in the MITRE ATT&CK framework under T1059 (Command and Scripting Interpreter) and T1566 (Phishing), where malicious model files serve as attack vectors for information gathering. Organizations using keras versions prior to 3.14.1 should implement immediate mitigations including updating to patched versions, implementing strict file validation policies, and ensuring that model files are processed only in secure sandboxes with restricted file system access. Additional defensive measures include monitoring for suspicious external link patterns in HDF5 files and implementing network segmentation to limit potential lateral movement through compromised model processing systems.