ray vulnerabilities
CVEs whose affected-version data names the ray package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
11 CVEsRSS
CVE-2026-57516High· 8.8PoCRay prior to 2.56.0 contains an unsafe deserialization vulnerability in the WebDataset reader that allows attackers to achieve remote code execution by supplying a malicious tar archive to the read_webdataset() function
Ray prior to 2.56.0 contains an unsafe deserialization vulnerability in the WebDataset reader that allows attackers to achieve remote code execution by supplying a malicious tar archive to the read_webdataset() function. The _default_dec…
CVE-2026-41486HighRay: Remote Code Execution via Parquet Arrow Extension Type Deserialization
Ray: Remote Code Execution via Parquet Arrow Extension Type Deserialization
CVE-2026-32981High· 7.5PoCA path traversal vulnerability was identified in Ray Dashboard (default port 8265) in Ray versions prior to 2.8.1
A path traversal vulnerability was identified in Ray Dashboard (default port 8265) in Ray versions prior to 2.8.1. Due to improper validation and sanitization of user-supplied paths in the static file handling mechanism, an attacker can …
CVE-2026-27482Medium· 5.9Ray dashboard DELETE endpoints allow unauthenticated browser-triggered DoS (Serve shutdown / job deletion)
Ray dashboard DELETE endpoints allow unauthenticated browser-triggered DoS (Serve shutdown / job deletion)
CVE-2025-34351CriticalRay's New Token Authentication is Disabled By Default
Ray's New Token Authentication is Disabled By Default
CVE-2025-62593High· 8.8CISA KEVPoCRay is an AI compute engine
Ray is an AI compute engine. Prior to version 2.52.0, developers working with Ray as a development tool can be exploited via a critical RCE vulnerability exploitable via Firefox and Safari. This vulnerability is due to an insufficient gu…
CVE-2025-1979Medium· 6.4ray vulnerable to Insertion of Sensitive Information into Log File
ray vulnerable to Insertion of Sensitive Information into Log File
CVE-2023-48022Critical· 9.8PoCRay has arbitrary code execution via jobs submission API
Ray has arbitrary code execution via jobs submission API
CVE-2023-6019Critical· 9.8PoCRay OS Command Injection vulnerability
Ray OS Command Injection vulnerability
CVE-2023-6020Critical· 9.3PoCRay Missing Authorization vulnerability
Ray Missing Authorization vulnerability
CVE-2023-6021Critical· 9.3PoCRay Path Traversal vulnerability
Ray Path Traversal vulnerability