CVE-2026-12482: Keras symlink bypass enables tar path

Q: Is CVE-2026-12482 actively exploited?

No confirmed active exploitation of CVE-2026-12482 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-12482?

Track keras-team/keras release notes and the linked huntr advisory for a patched version (patch version not yet published in available data) and upgrade as soon as it ships. Until patched: never call keras model-loading functions directly on archives from untrusted or unverified sources; pre-inspect tar-based model files with an independent tarfile scan that rejects any symlink/hardlink entries before handing the archive to keras; load third-party models inside an isolated, ephemeral, least-privilege container/sandbox with no sensitive host paths reachable via symlink targets and a read-only filesystem where feasible; add file-integrity monitoring on directories used for model extraction to detect unexpected writes outside the target directory; restrict which pipelines/service accounts are allowed to auto-load external model artifacts.

Q: What systems are affected by CVE-2026-12482?

This vulnerability affects the following AI/ML architecture patterns: training pipelines, model serving, MLOps pipelines.

Q: What is the CVSS score for CVE-2026-12482?

CVE-2026-12482 has a CVSS v3.1 base score of 3.1 (LOW). The EPSS exploitation probability is 0.24%.

CISO Take

keras-team/keras 3.12.0 fails to apply its own path-traversal check to symlink entries inside tar-based model archives, so a crafted archive can plant symlinks that resolve outside the intended extraction directory during model loading. With 1,527 downstream dependents, keras sits at the base of a large chunk of the Python ML stack, meaning any pipeline that loads model files from a model hub, shared research artifact, or CI/CD registry is potentially exposed to arbitrary file read, overwrite, or directory escape. There is no public exploit, no Nuclei template, and it is not in CISA KEV, and EPSS puts near-term opportunistic exploitation at only 0.3% — this is not an emergency patch-tonight item, but archive-extraction symlink bugs are trivially weaponizable once understood, and this is explicitly a bypass of a prior fix (distinct from CVE-2025-12060), which suggests the extraction hardening is still incomplete. Track the huntr advisory for a patched release, and in the meantime treat any keras model artifact from an untrusted source as executable content: load it in an isolated, least-privilege environment rather than directly on hosts with sensitive files reachable via symlink targets.

Sources: NVD EPSS OpenSSF ATLAS huntr.com

What is the risk?

Currently low near-term exploitability (EPSS 0.3%, no public PoC, no scanner template, not in KEV) but high potential impact if weaponized: a successful symlink escape converts an untrusted model file into an arbitrary file read/write primitive on the host or container running keras, which is a short hop to code execution (overwriting cron jobs, shell profiles, SSH authorized_keys, or application code). Exposure is amplified by keras's 1,527 downstream dependents and its role as a default loading path for shared/pretrained models across research, training, and serving workloads. The fact that this bypasses a previous fix (CVE-2025-12060) and specifically targets Python 3.10/3.11 (where filter_safe_tarinfos is the sole defense) indicates the underlying extraction hardening is architecturally incomplete, raising the odds of further bypasses.

How does the attack unfold?

Craft malicious archive

Attacker builds a tar-based Keras model archive embedding symlink entries designed to resolve outside the intended extraction directory.

AML.T0018.002

Distribute poisoned model

The archive is published on a model-sharing platform, code repo, or sent directly to a target developer/ML pipeline.

AML.T0058

Exploitation during load

Victim calls a keras model-loading function; filter_safe_tarinfos fails to validate the symlink target, so extraction follows it outside the sandboxed directory.

AML.T0011.000

File overwrite / read impact

The symlink is used to overwrite sensitive host files (e.g., SSH keys, cron jobs, application code) or read sensitive data, potentially escalating to full host compromise.

AML.T0112.001

Craft malicious archive

Attacker builds a tar-based Keras model archive embedding symlink entries designed to resolve outside the intended extraction directory.

AML.T0018.002

Distribute poisoned model

The archive is published on a model-sharing platform, code repo, or sent directly to a target developer/ML pipeline.

AML.T0058

Exploitation during load

Victim calls a keras model-loading function; filter_safe_tarinfos fails to validate the symlink target, so extraction follows it outside the sandboxed directory.

AML.T0011.000

File overwrite / read impact

The symlink is used to overwrite sensitive host files (e.g., SSH keys, cron jobs, application code) or read sensitive data, potentially escalating to full host compromise.

AML.T0112.001

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Keras	pip	< 3.12.3	`3.12.3`
64.3K OpenSSF 7.7 1.5K dependents Pushed yesterday 62% patched ~48d to patch Full package profile →
Keras	pip	—	No patch
64.3K OpenSSF 7.7 1.5K dependents Pushed yesterday 62% patched ~48d to patch Full package profile →

How severe is it?

CVSS 3.1

3.1 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 15% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC High

PR None

UI Required

S Unchanged

C None

I Low

A None

What should I do?

1 step

Track keras-team/keras release notes and the linked huntr advisory for a patched version (patch version not yet published in available data) and upgrade as soon as it ships. Until patched: never call keras model-loading functions directly on archives from untrusted or unverified sources; pre-inspect tar-based model files with an independent tarfile scan that rejects any symlink/hardlink entries before handing the archive to keras; load third-party models inside an isolated, ephemeral, least-privilege container/sandbox with no sensitive host paths reachable via symlink targets and a read-only filesystem where feasible; add file-integrity monitoring on directories used for model extraction to detect unexpected writes outside the target directory; restrict which pipelines/service accounts are allowed to auto-load external model artifacts.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Supply Chain Code Execution Framework Model AML.T0010.003 - Model AML.T0011.000 - Unsafe AI Artifacts AML.T0058 - Publish Poisoned Models AML.T0112.001 - AI Artifacts

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.10.2 - Third-party and customer relationships

NIST AI RMF

GOVERN 6.1 - Third-party risks and responsibilities

OWASP LLM Top 10

LLM03:2025 - Supply Chain

Frequently Asked Questions

What is CVE-2026-12482?

keras-team/keras 3.12.0 fails to apply its own path-traversal check to symlink entries inside tar-based model archives, so a crafted archive can plant symlinks that resolve outside the intended extraction directory during model loading. With 1,527 downstream dependents, keras sits at the base of a large chunk of the Python ML stack, meaning any pipeline that loads model files from a model hub, shared research artifact, or CI/CD registry is potentially exposed to arbitrary file read, overwrite, or directory escape. There is no public exploit, no Nuclei template, and it is not in CISA KEV, and EPSS puts near-term opportunistic exploitation at only 0.3% — this is not an emergency patch-tonight item, but archive-extraction symlink bugs are trivially weaponizable once understood, and this is explicitly a bypass of a prior fix (distinct from CVE-2025-12060), which suggests the extraction hardening is still incomplete. Track the huntr advisory for a patched release, and in the meantime treat any keras model artifact from an untrusted source as executable content: load it in an isolated, least-privilege environment rather than directly on hosts with sensitive files reachable via symlink targets.

Is CVE-2026-12482 actively exploited?

No confirmed active exploitation of CVE-2026-12482 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-12482?

Track keras-team/keras release notes and the linked huntr advisory for a patched version (patch version not yet published in available data) and upgrade as soon as it ships. Until patched: never call keras model-loading functions directly on archives from untrusted or unverified sources; pre-inspect tar-based model files with an independent tarfile scan that rejects any symlink/hardlink entries before handing the archive to keras; load third-party models inside an isolated, ephemeral, least-privilege container/sandbox with no sensitive host paths reachable via symlink targets and a read-only filesystem where feasible; add file-integrity monitoring on directories used for model extraction to detect unexpected writes outside the target directory; restrict which pipelines/service accounts are allowed to auto-load external model artifacts.

What systems are affected by CVE-2026-12482?

This vulnerability affects the following AI/ML architecture patterns: training pipelines, model serving, MLOps pipelines.

What is the CVSS score for CVE-2026-12482?

CVE-2026-12482 has a CVSS v3.1 base score of 3.1 (LOW). The EPSS exploitation probability is 0.24%.

What is the AI security impact?

Affected AI Architectures

training pipelinesmodel servingMLOps pipelines

MITRE ATLAS Techniques

AML.T0010.003 Model

AML.T0011.000 Unsafe AI Artifacts

AML.T0058 Publish Poisoned Models

AML.T0112.001 AI Artifacts

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.10.2

NIST AI RMF: GOVERN 6.1

OWASP LLM Top 10: LLM03:2025

What are the technical details?

Original Advisory

A vulnerability in keras-team/keras version 3.12.0 allows an attacker to craft a malicious tar archive that bypasses the `filter_safe_tarinfos` validation in `keras/src/utils/file_utils.py`. Specifically, symlink entries are not subjected to the same `is_path_in_dir` validation as regular file entries, allowing symlinks to be created outside the intended extraction directory. This can lead to symlink-based file read, file overwrite, or directory escape attacks. The issue is particularly impactful on Python 3.10 and 3.11, where `filter_safe_tarinfos` is the sole defense against tar path traversal. This vulnerability is distinct from CVE-2025-12060 and other previously reported issues.

Exploitation Scenario

An attacker crafts a Keras model archive (e.g., disguised as a useful pretrained model) containing a symlink tar entry that points outside the extraction target directory — for example targeting a user's ~/.ssh/authorized_keys, a cron directory, or an application config/script path. The attacker publishes or sends this archive via a model-sharing platform, GitHub repo, or direct message, relying on a data scientist or MLOps pipeline to call keras.models.load_model() on it. Because filter_safe_tarinfos only validates regular file entries with is_path_in_dir and skips the same check for symlinks, extraction follows the symlink and creates a file link outside the sandboxed directory; a subsequent write via a regular archive entry through that symlink overwrites the targeted host file, or a read exposes its contents back through the extracted archive, giving the attacker code execution or sensitive data access on the host running the training/serving pipeline.

Weaknesses (CWE)

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Primary CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Primary CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.