{"id":"CVE-2026-57516","title":"Ray prior to 2.56.0 contains an unsafe deserialization vulnerability in the WebDataset reader that allows attackers to achieve remote code execution by supplying a malicious tar archive to the read_webdataset() function","summary":"Ray prior to 2.56.0 contains an unsafe deserialization vulnerability in the WebDataset reader that allows attackers to achieve remote code execution by supplying a malicious tar archive to the read_webdataset() function. The _default_dec…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":["CWE-502"],"vendor":"anyscale","product":"ray","affected":["ray < 2.56.0"],"patched":["ray 2.56.0"],"published":"2026-07-01","updated":"2026-10-08","sourceUpdated":"2026-10-08T16:17:22.863","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-57516","references":[{"url":"https://github.com/ray-project/ray/pull/63469","label":"disclosure@vulncheck.com"},{"url":"https://github.com/ray-project/ray/pull/63470","label":"disclosure@vulncheck.com"},{"url":"https://github.com/ray-project/ray/releases/tag/ray-2.56.0","label":"disclosure@vulncheck.com"},{"url":"https://github.com/ray-project/ray/security/advisories/GHSA-hhrp-gw25-jr43","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/ray-unsafe-deserialization-rce-via-webdataset-reader","label":"disclosure@vulncheck.com"},{"url":"https://github.com/ray-project/ray/security/advisories/GHSA-hhrp-gw25-jr43","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-57516.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-57516"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496087"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-57516"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57516"},{"url":"https://access.redhat.com/errata/RHSA-2026:61627"},{"url":"https://access.redhat.com/errata/RHSA-2026:68699"},{"url":"https://access.redhat.com/errata/RHSA-2026:76041"},{"url":"https://access.redhat.com/errata/RHSA-2026:76043"},{"url":"https://github.com/ray-project/ray/commit/41443a18f9e6403a072de69098a279c23e2d943c"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/ray/PYSEC-2026-2273.yaml"},{"url":"https://github.com/ray-project/ray"}],"tags":["nvd","cve.org","exploit-available","csaf","vex","red-hat","osv","pip"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"total","timestamp":"2026-07-01T17:53:01.380220Z"},"epss":0.00858,"epssPercentile":0.58251,"aliases":["GHSA-hhrp-gw25-jr43","PYSEC-2026-2273"],"ecosystem":"pip","ingestedAt":"2026-07-13T18:58:08.788Z","slug":"CVE-2026-57516","body":"## Overview\n\nRay prior to 2.56.0 contains an unsafe deserialization vulnerability in the WebDataset reader that allows attackers to achieve remote code execution by supplying a malicious tar archive to the read_webdataset() function. The _default_decoder() function in webdataset_datasource.py unconditionally calls pickle.loads() on tar entries with .pkl/.pickle extensions and torch.load() with weights_only=False on .pt/.pth entries, executing arbitrary code inside Ray remote workers on every worker that processes the malicious archive.\n\n## Affected\n\n- `ray < 2.56.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `ray 2.56.0`\n\n## Package advisory (CVE-2026-57516)\n\nAffected packages:\n\n- `ray < 2.56.0`\n\nPatched in:\n\n- `ray 2.56.0`\n\nSource: https://osv.dev/vulnerability/GHSA-hhrp-gw25-jr43\n\n## Vendor advisories\n\n- **RHSA-2026:61627** · Red Hat · fixed in: Red Hat AI Inference Server 3.2 · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61627)\n- **RHSA-2026:68699** · Red Hat · fixed in: Red Hat AI Inference Server 3.3 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68699)\n- **RHSA-2026:76041** · Red Hat · fixed in: Red Hat Enterprise Linux AI 3.3 · released 2026-10-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:76041)\n- **RHSA-2026:76043** · Red Hat · fixed in: Red Hat Enterprise Linux AI 3.3 · released 2026-10-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:76043)\n- **Red Hat VEX** · Important · affected: Red Hat AI Inference Server, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI) · no fix planned: Red Hat AI Inference Server, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI) · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-57516.json)","depth":"midnight","depthScore":61,"depthScoreParts":{"impact":48.4,"likelihood":0.2,"exploitation":12,"ransomware":0},"changes":[{"seq":210266,"id":"CVE-2026-57516","ts":1790264828844,"field":"exploit_available","old":"false","new":"true"},{"seq":201824,"id":"CVE-2026-57516","ts":1789399727523,"field":"cvss","old":null,"new":"8.8"},{"seq":201823,"id":"CVE-2026-57516","ts":1789399727523,"field":"severity","old":"none","new":"high"},{"seq":200554,"id":"CVE-2026-57516","ts":1789397385464,"field":"cvss","old":"8.8","new":null},{"seq":200553,"id":"CVE-2026-57516","ts":1789397385464,"field":"severity","old":"high","new":"none"},{"seq":198471,"id":"CVE-2026-57516","ts":1789391969453,"field":"cvss","old":null,"new":"8.8"},{"seq":198470,"id":"CVE-2026-57516","ts":1789391969453,"field":"severity","old":"none","new":"high"},{"seq":196264,"id":"CVE-2026-57516","ts":1789383588464,"field":"cvss","old":"8.8","new":null},{"seq":196263,"id":"CVE-2026-57516","ts":1789383588464,"field":"severity","old":"high","new":"none"},{"seq":195193,"id":"CVE-2026-57516","ts":1789380477663,"field":"cvss","old":null,"new":"8.8"},{"seq":195192,"id":"CVE-2026-57516","ts":1789380477663,"field":"severity","old":"none","new":"high"},{"seq":193980,"id":"CVE-2026-57516","ts":1789378528290,"field":"cvss","old":"8.8","new":null},{"seq":193979,"id":"CVE-2026-57516","ts":1789378528290,"field":"severity","old":"high","new":"none"},{"seq":192767,"id":"CVE-2026-57516","ts":1789376408031,"field":"cvss","old":null,"new":"8.8"},{"seq":192766,"id":"CVE-2026-57516","ts":1789376408031,"field":"severity","old":"none","new":"high"},{"seq":191554,"id":"CVE-2026-57516","ts":1789373430231,"field":"cvss","old":"8.8","new":null},{"seq":191553,"id":"CVE-2026-57516","ts":1789373430231,"field":"severity","old":"high","new":"none"},{"seq":190339,"id":"CVE-2026-57516","ts":1789369300964,"field":"cvss","old":null,"new":"8.8"},{"seq":190338,"id":"CVE-2026-57516","ts":1789369300964,"field":"severity","old":"none","new":"high"},{"seq":189126,"id":"CVE-2026-57516","ts":1789368268336,"field":"cvss","old":"8.8","new":null},{"seq":189125,"id":"CVE-2026-57516","ts":1789368268336,"field":"severity","old":"high","new":"none"},{"seq":187909,"id":"CVE-2026-57516","ts":1789365144023,"field":"cvss","old":null,"new":"8.8"},{"seq":187908,"id":"CVE-2026-57516","ts":1789365144023,"field":"severity","old":"none","new":"high"},{"seq":186696,"id":"CVE-2026-57516","ts":1789363281791,"field":"cvss","old":"8.8","new":null},{"seq":186695,"id":"CVE-2026-57516","ts":1789363281791,"field":"severity","old":"high","new":"none"},{"seq":185482,"id":"CVE-2026-57516","ts":1789361102108,"field":"cvss","old":null,"new":"8.8"},{"seq":185481,"id":"CVE-2026-57516","ts":1789361102108,"field":"severity","old":"none","new":"high"},{"seq":184269,"id":"CVE-2026-57516","ts":1789358157649,"field":"cvss","old":"8.8","new":null},{"seq":184268,"id":"CVE-2026-57516","ts":1789358157649,"field":"severity","old":"high","new":"none"},{"seq":182520,"id":"CVE-2026-57516","ts":1789354223149,"field":"cvss","old":null,"new":"8.8"},{"seq":182519,"id":"CVE-2026-57516","ts":1789354223149,"field":"severity","old":"none","new":"high"},{"seq":181313,"id":"CVE-2026-57516","ts":1789353129393,"field":"cvss","old":"8.8","new":null},{"seq":181312,"id":"CVE-2026-57516","ts":1789353129393,"field":"severity","old":"high","new":"none"},{"seq":180106,"id":"CVE-2026-57516","ts":1789350169789,"field":"cvss","old":null,"new":"8.8"},{"seq":180105,"id":"CVE-2026-57516","ts":1789350169789,"field":"severity","old":"none","new":"high"},{"seq":178899,"id":"CVE-2026-57516","ts":1789348102794,"field":"cvss","old":"8.8","new":null},{"seq":178898,"id":"CVE-2026-57516","ts":1789348102794,"field":"severity","old":"high","new":"none"},{"seq":177692,"id":"CVE-2026-57516","ts":1789346278287,"field":"cvss","old":null,"new":"8.8"},{"seq":177691,"id":"CVE-2026-57516","ts":1789346278287,"field":"severity","old":"none","new":"high"},{"seq":176485,"id":"CVE-2026-57516","ts":1789343019825,"field":"cvss","old":"8.8","new":null},{"seq":176484,"id":"CVE-2026-57516","ts":1789343019825,"field":"severity","old":"high","new":"none"},{"seq":174602,"id":"CVE-2026-57516","ts":1789334772272,"field":"cvss","old":null,"new":"8.8"},{"seq":174601,"id":"CVE-2026-57516","ts":1789334772272,"field":"severity","old":"none","new":"high"},{"seq":173397,"id":"CVE-2026-57516","ts":1789333515911,"field":"cvss","old":"8.8","new":null},{"seq":173396,"id":"CVE-2026-57516","ts":1789333515911,"field":"severity","old":"high","new":"none"},{"seq":172211,"id":"CVE-2026-57516","ts":1789331018742,"field":"cvss","old":null,"new":"8.8"},{"seq":172210,"id":"CVE-2026-57516","ts":1789331018742,"field":"severity","old":"none","new":"high"},{"seq":171025,"id":"CVE-2026-57516","ts":1789328623107,"field":"cvss","old":"8.8","new":null},{"seq":171024,"id":"CVE-2026-57516","ts":1789328623107,"field":"severity","old":"high","new":"none"},{"seq":169820,"id":"CVE-2026-57516","ts":1789327051673,"field":"cvss","old":null,"new":"8.8"}]}