Which versions of Ray are affected by CVE-2026-57516?

Remote code execution vulnerability in Ray distributed computing framework (versions before 2.56.0) allows attackers to execute arbitrary code on remote workers through malicious tar archives…. A patch is available.

Is there a public PoC exploit available for CVE-2026-57516?

Yes, a public proof-of-concept exploit is available for CVE-2026-57516. Prioritise patching immediately. EPSS: 0.5%.

How to fix or mitigate CVE-2026-57516?

Within 24 hours: Inventory all Ray deployments and current versions in use, prioritizing production ML pipelines and distributed data processing environments. Within 7 days: Upgrade all Ray instances to version 2.56.0 or later, beginning with production systems. Within 30 days: Verify complete remediation across all development, staging, and production environments; document upgrade completion and test critical ML workflows post-patching.

Ray CVE-2026-57516

Q: What is the CVSS score of CVE-2026-57516?

CVE-2026-57516 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-41089 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-07-01 disclosure@vulncheck.com

GHSA-hhrp-gw25-jr43 PYSEC-2026-2273

RCE Deserialization Red Hat Ray Anyscale

8.6

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable data reader with no auth (PR:N) but a victim must ingest the malicious archive (UI:R); pickle deserialization yields full code execution, hence C/I/A:H and scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jul 01, 2026 - 18:02 EUVD

Analysis Generated

Jul 01, 2026 - 17:40 vuln.today

DescriptionCVE.org

Ray prior to 2.56.0 contains an unsafe deserialization vulnerability in the WebDataset reader that allows attackers to achieve remote code execution by supplying a malicious tar archive to the read_webdataset() function. The _default_decoder() function in webdataset_datasource.py unconditionally calls pickle.loads() on tar entries with .pkl/.pickle extensions and torch.load() with weights_only=False on .pt/.pth entries, executing arbitrary code inside Ray remote workers on every worker that processes the malicious archive.

AnalysisAI

Remote code execution in Ray (the distributed compute/ML framework) before version 2.56.0 lets attackers run arbitrary code by feeding a malicious tar archive to the WebDataset reader. The read_webdataset() datasource invokes pickle.loads() on .pkl/.pickle entries and torch.load() with weights_only=False on .pt/.pth entries with no validation, so code executes inside every Ray remote worker that processes the archive. No public exploit has been identified at time of analysis, but the fix is available in Ray 2.56.0 and the issue is documented in a GitHub Security Advisory (GHSA-hhrp-gw25-jr43) and a VulnCheck advisory.

Technical ContextAI

The root cause is CWE-502 (Deserialization of Untrusted Data). Ray Data's WebDataset integration reads sharded datasets packaged as tar archives, a common format in large-scale ML training pipelines. The vulnerable code path is _default_decoder() in webdataset_datasource.py, which dispatches decoding by file extension: entries ending in .pkl/.pickle are passed straight to Python's pickle.loads(), and .pt/.pth entries are loaded via PyTorch's torch.load() with weights_only=False. Both pickle and unrestricted torch.load reconstruct arbitrary Python objects and can execute code through __reduce__ during unpickling, so any attacker-controlled bytes in those entries become code execution. Because Ray distributes dataset reading across remote workers, the malicious payload runs on each worker node that touches the archive, amplifying impact across the cluster.

RemediationAI

Vendor-released patch: upgrade to Ray 2.56.0 or later, which contains the fixes from pull requests https://github.com/ray-project/ray/pull/63469 and https://github.com/ray-project/ray/pull/63470. If immediate upgrade is not possible, do not use read_webdataset() to ingest archives from untrusted or externally-controlled sources, and restrict WebDataset inputs to datasets you generate and store yourself; treat any third-party or user-uploaded tar shards as executable code. As a compensating control, avoid or strip .pkl/.pickle/.pt/.pth entries from incoming archives and source datasets only from trusted, integrity-verified storage - the trade-off is that legitimate pickled or PyTorch-serialized samples in those datasets will no longer load, which may break existing pipelines. Refer to the advisory at https://github.com/ray-project/ray/security/advisories/GHSA-hhrp-gw25-jr43 for authoritative guidance.