CVE-2026-1462: Vulnerability Analysis

Executive summary

In version 3.13.0 of the keras package, the TFSMLayer class loads attacker-controlled TensorFlow SavedModels when it deserializes a .keras model, even when safe_mode=True. That defeats the protection safe_mode is meant to give, and it lets attacker-controlled code run during model inference with the victim's privileges.

An error stopped the full analysis from being generated, so this post contains only the technical specifications and references below.

Technical specifications

• CVE ID: CVE-2026-1462
• Vendors: Unknown
• Date Reported: 2026-04-13T15:17:18.967
• CVSS Score: 8.8
• Description: A vulnerability in the TFSMLayer class of the keras package, version 3.13.0, lets attacker-controlled TensorFlow SavedModels load during deserialization of .keras models, even when safe_mode=True. This bypasses the security guarantees of safe_mode and allows arbitrary attacker-controlled code to run during model inference under the victim's privileges. Three things cause it: external SavedModels load unconditionally, attacker-controlled file paths are serialized, and the from_config() method performs no validation.
• CWE IDs: CWE-502

References

• https://github.com/keras-team/keras/commit/b6773d3decaef1b05d8e794458e148cb362f163f
• https://huntr.com/bounties/7e78d6f1-6977-4300-b595-e81bdbda331c