CVE-2026-57516
published 2026-07-01CVE-2026-57516: Ray prior to 2.56.0 contains an unsafe deserialization vulnerability in the WebDataset reader that allows attackers to achieve remote code execution by…
PriorityP356high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
0.55%
43.6th percentile
Ray prior to 2.56.0 contains an unsafe deserialization vulnerability in the WebDataset reader that allows attackers to achieve remote code execution by supplying a malicious tar archive to the read_webdataset() function. The _default_decoder() function in webdataset_datasource.py unconditionally calls pickle.loads() on tar entries with .pkl/.pickle extensions and torch.load() with weights_only=False on .pt/.pth entries, executing arbitrary code inside Ray remote workers on every worker that processes the malicious archive.
Affected
19 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| anyscale | ray | < 2.56.0 | 2.56.0 |
| anyscale | ray | >= 0 < 2.56.0 | 2.56.0 |
| anyscale_inc | ray | < 2.56.0 | 2.56.0 |
| rhaii | vllm-gaudi-rhel9 | — | — |
| rhaiis | vllm-cuda-rhel9 | — | — |
| rhelai3 | bootc-gaudi-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-datascience-cpu-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-pytorch-cuda-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-pytorch-rocm-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-tensorflow-cuda-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-tensorflow-rocm-py312-rhel9 | — | — |
| rhoai | odh-vllm-gaudi-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-datascience-cpu-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-pytorch-cuda-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-pytorch-rocm-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-tensorflow-cuda-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-tensorflow-rocm-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-trustyai-cpu-py312-rhel9 | — | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv4.08.6HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
ray: Ray: Remote code execution via unsafe deserialization in WebDataset reader
vendor_redhat·2026-07-01·CVSS 8.8
CVE-2026-57516 [HIGH] CWE-502 ray: Ray: Remote code execution via unsafe deserialization in WebDataset reader
ray: Ray: Remote code execution via unsafe deserialization in WebDataset reader
Ray prior to 2.56.0 contains an unsafe deserialization vulnerability in the WebDataset reader that allows attackers to achieve remote code execution by supplying a malicious tar archive to the read_webdataset() function. The _default_decoder() function in webdataset_datasource.py unconditionally calls pickle.loads() on tar entries with .pkl/.pickle extensions and torch.load() with weights_only=False on .pt/.pth entries, executing arbitrary code inside Ray remote workers on every worker that processes the malicious archive.
A flaw was found in Ray. This unsafe deserialization vulnerability in the WebDataset reader allows a remote attacker to achieve arbitrary code execution. By supplying a specially crafted ma
GHSA
Ray: Arbitrary code execution via ray.data.read_webdataset default decoder: pickle.loads(value) and torch.load(weights_only=False)
ghsa·2026-07-24
CVE-2026-57516 [HIGH] CWE-502 Ray: Arbitrary code execution via ray.data.read_webdataset default decoder: pickle.loads(value) and torch.load(weights_only=False)
Ray: Arbitrary code execution via ray.data.read_webdataset default decoder: pickle.loads(value) and torch.load(weights_only=False)
## Summary
`ray.data.read_webdataset(paths=...)` is a `@PublicAPI(stability="alpha")`
reader for WebDataset-format TAR files. Its default `decoder=True` invokes
`_default_decoder` on every sample's keys, which routes file extension to a
decoder by extension. Two of those branches deserialize attacker-controlled
bytes with no validation:
- `.pickle` / `.pkl` -> `pickle.loads(value)`
- `.pt` / `.pth` -> `torch.load(io.BytesIO(value), weights_only=False)`
Both fire during a standard `ray.data.read_webdataset(...).take_all()` /
`.iter_batches()` call. No flags, no opt-in, no environment variable.
An attacker who can supply a TAR (via S3 share, HuggingFace Hub m
VulDB
Anyscale Ray up to 2.55.x webdataset_datasource.py read_webdataset deserialization (GHSA-hhrp-gw25-jr43)
vuldb·2026-07-01·CVSS 8.8
CVE-2026-57516 [HIGH] Anyscale Ray up to 2.55.x webdataset_datasource.py read_webdataset deserialization (GHSA-hhrp-gw25-jr43)
A vulnerability was found in Anyscale Ray up to 2.55.x and classified as critical. Affected is the function read_webdataset of the file webdataset_datasource.py. Such manipulation leads to deserialization.
This vulnerability is listed as CVE-2026-57516. The attack may be performed from remote. There is no available exploit.
It is suggested to upgrade the affected component.
No detection rules found.
No public exploits indexed.
https://github.com/ray-project/ray/pull/63469https://github.com/ray-project/ray/pull/63470https://github.com/ray-project/ray/releases/tag/ray-2.56.0https://github.com/ray-project/ray/security/advisories/GHSA-hhrp-gw25-jr43https://www.vulncheck.com/advisories/ray-unsafe-deserialization-rce-via-webdataset-readerhttps://github.com/ray-project/ray/security/advisories/GHSA-hhrp-gw25-jr43
2026-07-01
Published