CVE-2026-2492

TensorFlow HDF5 Library Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of TensorFlow. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of plugins. The application loads plugins from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of a target user. Was ZDI-CAN-25480.

An attacker compromises a low-privileged account on a shared GPU training cluster (e.g., via a malicious Jupyter notebook, stolen SSH key, or exploited web-facing ML service). They identify TensorFlow's plugin search path on the local filesystem—a world-writable or user-accessible directory. The attacker drops a crafted shared library (.so) into this path. When a privileged user or automated training pipeline subsequently invokes TensorFlow with HDF5 operations (e.g., loading .h5 model weights or datasets), TensorFlow loads the attacker's malicious plugin, executing arbitrary code in the higher-privileged context. Post-escalation, the attacker can exfiltrate trained models, access proprietary training data, establish persistence, or pivot to the broader ML infrastructure.