External risk intelligence

Keras Lambda Layer Deserialization Vulnerability Allows Arbitrary Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-12481

Keras is a library for local development and data pipelines, not an internet-facing service or appliance. This vulnerability involves deserializing untrusted model configurations, which typically occurs within isolated internal research or application environments rather than through direct, unauthenticated public network exposure.

Deserialization

Keras

3.14.0

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability exists in the Keras library that could allow for arbitrary code execution if a malicious model configuration is deserialized. This type of issue arises from an improper handling of security checks during the deserialization process, potentially impacting systems that load model configurations from untrusted sources. The main concern is confirming relevance and exposure to this specific library and its usage patterns within our environment.

Code execution flaw in a machine learning library.
Matters if loading untrusted model configurations.
Confirm Keras relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by tricking a system into deserializing a specially crafted configuration. This configuration would target the `Lambda` layer within Keras, bypassing security checks to execute arbitrary code. This could happen when loading models or layers, potentially leading to the execution of malicious commands on the affected system.

No authentication or user interaction needed.
Triggered by deserializing a malicious configuration.
Allows arbitrary OS code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow arbitrary code execution when untrusted model configurations are processed without proper safety checks. This may affect the integrity and availability of the affected system or user process.

Arbitrary OS-level code execution.
Deserializing untrusted configurations.
Compromised server or user process.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Keras library's deserialization vulnerability requires immediate attention from teams responsible for AI/ML model development and deployment. The first step is to identify all instances of Keras where model configurations might be loaded from untrusted sources. Confirming the scope of exposure and identifying the specific applications or services utilizing the vulnerable Keras version will be critical for risk-based remediation planning.

AI/ML platform or application owners.
Verify untrusted model configuration loading.
Plan remediation based on risk exposure.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Keras and where is it used?

Keras is a popular open-source deep learning library designed for building and training neural networks. It is widely used by researchers and data scientists to construct machine learning models and data pipelines. Because it acts as an interface for backend engines like TensorFlow, it is frequently embedded within custom Python applications, data processing services, and AI/ML development environments rather than existing as a standalone server or network appliance.

How does CVE-2026-12481 lead to arbitrary code execution?

This vulnerability is classified as CWE-502: Deserialization of Untrusted Data. It occurs because the Lambda layer in Keras incorrectly handles safety settings when processing model configurations. If an attacker provides a crafted configuration, the library's internal logic fails to apply necessary security guards, allowing it to interpret attacker-controlled bytecode. This results in the system executing unintended instructions, granting the attacker the ability to run arbitrary commands on the host OS.

What triggers this Keras vulnerability?

The flaw is triggered when the software deserializes a model configuration from an untrusted source, specifically targeting the Lambda layer's configuration loading. It is important to note that if the application code explicitly wraps the model loading process in a 'SafeModeScope(True)' context, the guard is correctly enforced, and the vulnerability is not triggered. The bug specifically exploits a logic gap that occurs when 'safe_mode' is left at its default 'None' value.

Do I need to worry about this CVE if my app is internal?

According to Halo Surface Signal, this vulnerability is considered 'Very unlikely' to be exploited via direct public network access because Keras is typically used within isolated internal development or research pipelines. You should focus your concern on applications or automated services that accept and deserialize model files from external or untrusted users. If your internal environment strictly controls who can submit model configurations, the practical risk is significantly reduced.

When should I prioritize fixing this Keras issue?

Prioritize remediation if you run version 3.14.0 of Keras in environments that automatically load or deserialize model configurations provided by third parties. Your first step should be to audit your codebase to identify all locations where 'keras.layers.deserialize' or similar model-loading functions are called. Confirm whether these processes handle input from untrusted sources and evaluate if wrapping those specific calls in a 'SafeModeScope' can mitigate the risk while you plan an update.

References

huntr.com/bounties/59ceaed1-c8a3-4135-8f94-169ade02823d

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.