Ray CVE-2026-57516

Exploitation requires that a Ray Data pipeline actually invokes read_webdataset() and processes an attacker-supplied tar archive containing an entry with a .pkl, .pickle, .pt, or .pth extension - this maps to the CVSS UI:A (active user interaction) requirement, meaning a victim or automated job must ingest the malicious archive. No authentication is needed against Ray itself (PR:N) and no special Ray configuration is required beyond use of the WebDataset reader, which is the default decoder behavior for that datasource. The primary limiting factor is data provenance: if the cluster only reads WebDataset archives from trusted, internally-controlled sources, an attacker has no delivery channel; the vulnerability becomes exploitable specifically when untrusted, externally-sourced, or user-uploaded datasets are fed into the reader. Affected only on Ray versions prior to 2.56.0.

The supplied CVSS 4.0 score is 8.6 with vector AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H, meaning network-reachable, low-complexity, no privileges, but requiring active user interaction (a victim/pipeline must actually ingest the attacker's archive) with full confidentiality, integrity and availability impact and no scope change to other systems. No EPSS score, KEV entry, or public POC was provided, so exploitation probability cannot be quantified from the input - the risk is driven by the deserialization primitive itself, which is reliably weaponizable once the archive is processed. The UI:A requirement is the key limiting factor: this is not autonomous internet-wide RCE but rather a supply-chain / untrusted-data-ingestion risk. For teams running Ray Data pipelines that consume externally-sourced or user-uploaded WebDataset archives this is a genuine high priority; for clusters that only process trusted, internally-generated datasets the practical risk is materially lower. Note: only a CVSS 4.0 vector was provided (no 3.1 vector and no EPSS/KEV signals), so cross-signal corroboration is limited.

An attacker crafts a WebDataset tar archive containing a .pkl (or .pt) entry whose serialized payload runs a shell command via pickle's __reduce__ mechanism, then gets it into a data pipeline - for example by uploading it to a shared dataset bucket or publishing it as a public training set. When a Ray Data job calls read_webdataset() on that archive, _default_decoder() deserializes the entry and the attacker's code executes on every Ray worker that processes the shard. No public exploit code was identified at time of analysis, but the technique is standard and reliable given the low attack complexity (AC:L).