CVE-2026-57516
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
Ray prior to 2.56.0 contains an unsafe deserialization vulnerability in the WebDataset reader. An attacker can achieve remote code execution by supplying a malicious tar archive to the read_webdataset() function, which unconditionally calls pickle.loads() on .pkl/.pickle entries and torch.load() with weights_only=False on .pt/.pth entries, executing arbitrary code on every remote worker processing the archive.
Risk Assessment
The risk for the organization includes full compromise of the Ray cluster by a remote attacker, potentially leading to data theft, service disruption, or further attacks on infrastructure.
Recommendation
Immediately upgrade Ray to version 2.56.0 or later. Until the update is applied, restrict access to the read_webdataset() function from untrusted data sources.
Other vulnerabilities in Ray
See all- CVE-2025-62593HighActively exploited
Ray is an AI compute engine. Prior to version 2.52.0, developers using Ray as a development tool can be exploited via a critical RCE vulnerability exploitable via Firefox and Safari. This is due to insufficient guard against browser-based attacks, as the current defense uses the User-Agent header starting with 'Mozilla'. This defense is insufficient because the fetch specification allows modifying the User-Agent header. Combined with DNS rebinding, the vulnerability is exploitable against a developer who inadvertently visits a malicious website or sees a malicious ad. Patched in version 2.52.0.
- CVE-2026-32981High
A path traversal vulnerability in Ray Dashboard (default port 8265) in versions prior to 2.8.1. Improper validation and sanitization of user-supplied paths in the static file handling mechanism allows an attacker to use traversal sequences (e.g., ../) to access files outside the intended static directory, resulting in local file disclosure.
Original NVD description (English source)
Ray prior to 2.56.0 contains an unsafe deserialization vulnerability in the WebDataset reader that allows attackers to achieve remote code execution by supplying a malicious tar archive to the read_webdataset() function. The _default_decoder() function in webdataset_datasource.py unconditionally calls pickle.loads() on tar entries with .pkl/.pickle extensions and torch.load() with weights_only=False on .pt/.pth entries, executing arbitrary code inside Ray remote workers on every worker that processes the malicious archive.