CVE-2026-57516 with a CVSS score of 8.6 is an unsafe deserialization vulnerability affecting the Ray machine learning framework. This flaw exists within the read_webdataset function, where the default decoder unconditionally deserializes untrusted data using unsafe methods like pickle.loads() and torch.load() without proper validation. An attacker can exploit this issue by inducing a user or system to process a malicious tar archive containing specifically crafted file extensions like .pkl or .pth, requiring only network access and minimal user interaction to trigger the vulnerability. Successful exploitation grants the attacker the ability to execute arbitrary code within the Ray remote workers or the calling process. This poses severe business risks, including the potential for complete system compromise, data theft, and service disruption due to the high impact on confidentiality, integrity, and availability. Exploitation is specifically contingent upon the target utilizing the default decoder settings while ingesting attacker-controlled datasets from sources such as S3 buckets or HTTP URLs.
We recommend you to update ray to version 2.56.1 or later.[/subscribe_to_unlock_form]
CVE-2026-57516 with a CVSS score of 8.6 is an unsafe deserialization vulnerability affecting the Ray machine learning framework. This flaw exists within the read_webdataset function, where the default decoder unconditionally deserializes untrusted data using unsafe methods like pickle.loads() and torch.load() without proper validation. An attacker can exploit this issue by inducing a user or system to process a malicious tar archive containing specifically crafted file extensions like .pkl or .pth, requiring only network access and minimal user interaction to trigger the vulnerability. Successful exploitation grants the attacker the ability to execute arbitrary code within the Ray remote workers or the calling process. This poses severe business risks, including the potential for complete system compromise, data theft, and service disruption due to the high impact on confidentiality, integrity, and availability. Exploitation is specifically contingent upon the target utilizing the default decoder settings while ingesting attacker-controlled datasets from sources such as S3 buckets or HTTP URLs.
We recommend you to update ray to version 2.56.1 or later.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]