CVE-2026-9335 keras-team CVE debrief

Who should care

Organizations and individuals using keras-team/keras versions <= 3.14.0, especially those handling sensitive data, should prioritize updating to a secure version to prevent potential sensitive data disclosure. This includes reviewing compensating controls for exposed systems while remediation is scheduled and verified, and checking relevant monitoring, detection, and logs for exposed assets that need extra review. Affected operators, platforms, vulnerability-management, and security teams should be aware of the potential impact and take necessary actions to mitigate the vulnerability. Additionally, asset inventory and rollback/change windows should be reviewed to ensure proper mitigation and remediation. Source tracking and exposure review are also crucial in addressing this vulnerability. Monitoring and compensating controls can help detect and prevent potential attacks. It is essential to assign an owner for follow-up and track exceptions, retest remediated assets, and close the item only after evidence is documented. The CVE record and official advisory should be reviewed to validate affected scope, severity, and vendor guidance. Overall, a comprehensive approach is necessary to address the potential risks associated with this vulnerability. The affected product deployments should be identified in managed environments, and an owner should be assigned for follow-up. The official advisory or CVE record should be reviewed to validate affected scope, severity, and vendor guidance. Vendor-supported updates or mitigations should be planned through normal change control where exposure is confirmed. Compensating controls should be reviewed for exposed systems while remediation is scheduled and verified. Relevant monitoring, detection, and logs should be checked for exposed assets that need extra review. Exceptions should be tracked, remediated assets should be retested, and the item should be closed only after evidence is documented. The debrief and technical summary provide further context on the vulnerability and its potential impact. Evidence notes and recommended actions are also provided to support the mitigation and remediation efforts. The defensive priority,

Technical summary

The `KerasFileEditor` and `keras.saving.load_weights` functions in keras-team/keras versions <= 3.14.0 improperly handle HDF5 ExternalLinks, allowing attackers to disclose sensitive data from the victim's local filesystem by providing a malicious `.h5`, `.weights.h5`, or `.keras` file. Specifically, these functions bypass the `safe_get_h5_group` and `safe_get_h5_dataset` helpers, which are designed to reject ExternalLinks and SoftLinks. This results in automatic dereferencing of links to external HDF5 files, enabling attackers to disclose sensitive data.

Defensive priority

Organizations using keras-team/keras versions <= 3.14.0 should prioritize updating to a secure version to prevent potential sensitive data disclosure.

Recommended defensive actions

• Update keras-team/keras to a version greater than 3.14.0
• Restrict access to sensitive HDF5 files
• Monitor for suspicious file access patterns
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE-2026-9335 issue allows arbitrary local HDF5 file content disclosure due to improper handling of HDF5 ExternalLinks in keras-team/keras versions <= 3.14.0. Specifically, the `KerasFileEditor` and `keras.saving.load_weights` functions bypass safety helpers, enabling attackers to disclose sensitive data from the victim's local filesystem by providing a malicious `.h5`, `.weights.h5`, or `.keras` file.

Official resources