CVE-2026-12484

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-12484", "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "state": "PUBLISHED", "assignerShortName": "@huntr_ai", "dateReserved": "2026-06-17T02:52:42.641Z", "datePublished": "2026-07-19T19:47:27.743Z", "dateUpdated": "2026-07-20T13:45:55.809Z"}, "containers": {"cna": {"title": "Unsafe Deserialization in keras.layers.TorchModuleWrapper.from_config", "providerMetadata": {"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "shortName": "@huntr_ai", "dateUpdated": "2026-07-19T19:47:27.743Z"}, "descriptions": [{"lang": "en", "value": "A vulnerability in keras-team/keras version 3.15.0 allows unsafe deserialization of attacker-controlled PyTorch pickle data through the public `keras.layers.TorchModuleWrapper.from_config` method. This method invokes `torch.load(..., weights_only=False)` without requiring an explicit unsafe opt-in, such as a `safe_mode=False` parameter. When called outside a `SafeModeScope(True)` context, the absence of an ambient safe mode state permits unsafe deserialization by default. This issue can lead to arbitrary code execution if untrusted Keras layer configurations are processed using this method. The vulnerability arises because the method does not enforce safe deserialization practices unless explicitly guarded by Keras safe mode."}], "affected": [{"vendor": "keras-team", "product": "keras-team/keras", "versions": [{"version": "unspecified", "status": "affected", "versionType": "custom", "lessThanOrEqual": "latest"}]}], "references": [{"url": "https://huntr.com/bounties/ab14df49-13b5-4442-b754-3189430bfa28"}], "metrics": [{"cvssV3_0": {"version": "3.0", "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-502 Deserialization of Untrusted Data", "cweId": "CWE-502"}]}], "source": {"advisory": "ab14df49-13b5-4442-b754-3189430bfa28", "discovery": "EXTERNAL"}}, "adp": [{"references": [{"url": "https://huntr.com/bounties/ab14df49-13b5-4442-b754-3189430bfa28", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-20T13:45:26.059176Z", "id": "CVE-2026-12484", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-20T13:45:55.809Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-12484", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-20T13:45:26.059176Z"}}}], "references": [{"url": "https://huntr.com/bounties/ab14df49-13b5-4442-b754-3189430bfa28", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-20T13:45:51.439Z"}}], "cna": {"title": "Unsafe Deserialization in keras.layers.TorchModuleWrapper.from_config", "source": {"advisory": "ab14df49-13b5-4442-b754-3189430bfa28", "discovery": "EXTERNAL"}, "metrics": [{"cvssV3_0": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "keras-team", "product": "keras-team/keras", "versions": [{"status": "affected", "version": "unspecified", "versionType": "custom", "lessThanOrEqual": "latest"}]}], "references": [{"url": "https://huntr.com/bounties/ab14df49-13b5-4442-b754-3189430bfa28"}], "descriptions": [{"lang": "en", "value": "A vulnerability in keras-team/keras version 3.15.0 allows unsafe deserialization of attacker-controlled PyTorch pickle data through the public `keras.layers.TorchModuleWrapper.from_config` method. This method invokes `torch.load(..., weights_only=False)` without requiring an explicit unsafe opt-in, such as a `safe_mode=False` parameter. When called outside a `SafeModeScope(True)` context, the absence of an ambient safe mode state permits unsafe deserialization by default. This issue can lead to arbitrary code execution if untrusted Keras layer configurations are processed using this method. The vulnerability arises because the method does not enforce safe deserialization practices unless explicitly guarded by Keras safe mode."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-502", "description": "CWE-502 Deserialization of Untrusted Data"}]}], "providerMetadata": {"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "shortName": "@huntr_ai", "dateUpdated": "2026-07-19T19:47:27.743Z"}}}, "cveMetadata": {"cveId": "CVE-2026-12484", "state": "PUBLISHED", "dateUpdated": "2026-07-20T13:45:55.809Z", "dateReserved": "2026-06-17T02:52:42.641Z", "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "datePublished": "2026-07-19T19:47:27.743Z", "assignerShortName": "@huntr_ai"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "keras-team/keras", "vendor": "keras-team", "versions": [{"lessThanOrEqual": "latest", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "source": "security@huntr.dev"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability in keras-team/keras version 3.15.0 allows unsafe deserialization of attacker-controlled PyTorch pickle data through the public `keras.layers.TorchModuleWrapper.from_config` method. This method invokes `torch.load(..., weights_only=False)` without requiring an explicit unsafe opt-in, such as a `safe_mode=False` parameter. When called outside a `SafeModeScope(True)` context, the absence of an ambient safe mode state permits unsafe deserialization by default. This issue can lead to arbitrary code execution if untrusted Keras layer configurations are processed using this method. The vulnerability arises because the method does not enforce safe deserialization practices unless explicitly guarded by Keras safe mode."}, {"lang": "es", "value": "Una vulnerabilidad en keras-team/keras versi\u00f3n 3.15.0 permite la deserializaci\u00f3n insegura de datos pickle de PyTorch controlados por el atacante a trav\u00e9s del m\u00e9todo p\u00fablico \u2019keras.layers.TorchModuleWrapper.from_config\u2019. Este m\u00e9todo invoca \u2019torch.load(..., weights_only=False)\u2019 sin requerir una activaci\u00f3n expl\u00edcita de modo inseguro, como un par\u00e1metro \u2019safe_mode=False\u2019. Cuando se llama fuera de un contexto \u2019SafeModeScope(True)\u2019, la ausencia de un estado de modo seguro ambiental permite la deserializaci\u00f3n insegura por defecto. Este problema puede llevar a la ejecuci\u00f3n de c\u00f3digo arbitrario si se procesan configuraciones de capas de Keras no confiables utilizando este m\u00e9todo. La vulnerabilidad surge porque el m\u00e9todo no impone pr\u00e1cticas de deserializaci\u00f3n segura a menos que est\u00e9 expl\u00edcitamente protegido por el modo seguro de Keras."}], "id": "CVE-2026-12484", "lastModified": "2026-10-24T20:10:00.137", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "security@huntr.dev", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-12484", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-20T13:45:26.059176Z", "version": "2.0.3"}}]}, "published": "2026-07-19T20:16:28.800", "references": [{"source": "security@huntr.dev", "url": "https://huntr.com/bounties/ab14df49-13b5-4442-b754-3189430bfa28"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://huntr.com/bounties/ab14df49-13b5-4442-b754-3189430bfa28"}], "sourceIdentifier": "security@huntr.dev", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-502"}], "source": "security@huntr.dev", "type": "Secondary"}]}

{"bugzilla": {"description": "keras: torch: Keras: Arbitrary code execution via unsafe deserialization of PyTorch data", "id": "2502670", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502670"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-502", "details": ["A vulnerability in keras-team/keras version 3.15.0 allows unsafe deserialization of attacker-controlled PyTorch pickle data through the public `keras.layers.TorchModuleWrapper.from_config` method. This method invokes `torch.load(..., weights_only=False)` without requiring an explicit unsafe opt-in, such as a `safe_mode=False` parameter. When called outside a `SafeModeScope(True)` context, the absence of an ambient safe mode state permits unsafe deserialization by default. This issue can lead to arbitrary code execution if untrusted Keras layer configurations are processed using this method. The vulnerability arises because the method does not enforce safe deserialization practices unless explicitly guarded by Keras safe mode.", "A flaw was found in Keras, specifically within the `keras.layers.TorchModuleWrapper.from_config` method. This vulnerability allows an attacker to perform unsafe deserialization of PyTorch pickle data. By processing untrusted Keras layer configurations, a local attacker could exploit this flaw, leading to arbitrary code execution. This occurs because the method does not enforce safe deserialization practices by default, potentially allowing malicious code to run on the system."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, ensure that Red Hat OpenShift AI environments only process Keras layer configurations from trusted sources. Avoid loading or processing any untrusted Keras layer configurations, as this vulnerability can lead to arbitrary code execution."}, "name": "CVE-2026-12484", "package_state": [{"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Not affected", "package_name": "rhoai/odh-kserve-agent-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Not affected", "package_name": "rhoai/odh-kserve-controller-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Not affected", "package_name": "rhoai/odh-kserve-router-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Not affected", "package_name": "rhoai/odh-kserve-storage-initializer-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-modelmesh-runtime-adapter-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}], "public_date": "2026-07-19T19:47:27Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-12484\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-12484\nhttps://huntr.com/bounties/ab14df49-13b5-4442-b754-3189430bfa28"], "statement": "This Important vulnerability affects Red Hat OpenShift AI components utilizing Keras for model processing. A local attacker could achieve arbitrary code execution by providing untrusted Keras layer configurations, which are then unsafely deserialized by the `keras.layers.TorchModuleWrapper.from_config` method. This risk is present when users process external or unverified model configurations within their OpenShift AI deployments.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "keras-team/keras", "source": "cna", "vendor": "keras-team"}, "product": "keras", "vendor": "keras-team"}], "created": "2026-07-21T21:30:06.815344+00:00", "updated": "2026-08-01T07:30:13.332974+00:00", "vendors": ["keras-team", "keras-team$PRODUCT$keras"]}