Keras (HDF5 external links): Arbitrary local file read during model load

Impact

Arbitrary local file read during model load

Who can reach it

Customer-supplied HDF5 model — reads provider or co-tenant files visible to the process

What to do

Upgrade; better, disallow HDF5. Note the process' service-account tokens and mounted secrets are in scope

References

Related entries

• OpenShift AI Data Science Pipelines Operator: predictable PRNG generates MariaDB and MinIO credentialsCVE-2026-18611 · Red Hat OpenShift AI Data Science Pipelines Operator (generated MariaDB and MinIO credentials)High
• MLflow: unauthenticated arbitrary file read via prompt-tagged model version source pathCVE-2026-2614 · MLflow tracking server (`_create_model_version` / model version artifact handler)High
• Ray Dashboard: Path traversal in the dashboard static-file handler (port 8265)CVE-2026-32981 · Ray DashboardHigh
• LangChain: prompt config files are loaded from unvalidated paths, letting a caller read arbitrary host filesCVE-2026-34070 · LangChain langchain-core prompt loading (load_prompt / load_prompt_from_config)High
• vLLM: unbounded media download from user-supplied URLs exhausts inference server memoryCVE-2026-37237 · vLLM multimodal input fetcher (`AsyncMediaIO.fetch_audio` / `fetch_image`)High
• vLLM (activation function loading): Assert-based security check bypass, unauthenticatedCVE-2026-41523 · vLLM (activation function loading)High