PT-2026-32367 · Keras · Keras

Fabien Hertschuh · Published 2026-04-13 · Updated 2026-04-13 · CVE-2026-1462

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions keras version 3.13.0

Description A flaw in the TFSMLayer class allows attacker-controlled TensorFlow SavedModels to be loaded during the deserialization of .keras models. This occurs even when safe mode=True is enabled, bypassing security guarantees and enabling arbitrary code execution during model inference under the victim's privileges. The issue is caused by the unconditional loading of external SavedModels, serialization of attacker-controlled file paths, and a lack of validation in the from config() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2026-1462

GHSA-4F3F-G24H-FR8M

Affected Products

Keras

References · 13

• https://security-tracker.debian.org/tracker/CVE-2026-1462 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-1462 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-1462 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4f3f-g24h-fr8m · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-1462 · Security Note
• https://ubuntu.com/security/CVE-2026-1462 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-1462 · Vendor Advisory
• https://github.com/keras-team/keras · Note
• https://github.com/keras-team/keras/pull/22035 · Note
• https://github.com/keras-team/keras/commit/b6773d3decaef1b05d8e794458e148cb362f163f · Note
• https://huntr.com/bounties/7e78d6f1-6977-4300-b595-e81bdbda331c · Note
• https://twitter.com/CveFindCom/status/2043754149121012104 · Twitter Post
• https://twitter.com/CVEnew/status/2043733033879310490 · Twitter Post