CVE-2026-1462: Safe Mode Bypass in keras-team/keras
A vulnerability in the TFSMLayer class of the keras package, version 3.13.0, allows attacker-controlled TensorFlow SavedModels to be loaded during deserialization of .keras models, even when safemode=True. This bypasses the security guarantees of safemode and enables arbitrary attacker-controlled code execution during model inference under the victim's privileges. The issue arises due to the unconditional loading of external SavedModels, serialization of attacker-controlled file paths, and the lack of validation in the fromconfig() method.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
kerasto a version that resolves this vulnerability.Fixed in 3.13.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-1462?
CVE-2026-1462 has a high severity rating of 7.8 according to the CVSS 3.1 scoring system.
How do I fix CVE-2026-1462?
To mitigate CVE-2026-1462, it is recommended to upgrade to a patched version of the keras package where the vulnerability is resolved.
What impacts does CVE-2026-1462 have on users?
CVE-2026-1462 allows attackers to bypass the safe mode settings and potentially execute malicious code through attacker-controlled TensorFlow SavedModels.
Which version of keras is affected by CVE-2026-1462?
The vulnerability exists in version 3.13.0 of the keras package.
Does CVE-2026-1462 affect other platforms besides keras?
While CVE-2026-1462 specifically affects the keras package, it may also impact applications that rely on the keras package for their machine learning models.