{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aanyscaleray/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:anyscale:ray:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-57516"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Ray (\u003c 2.56.0)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","deserialization","rce","ray","execution"],"_cs_type":"advisory","_cs_vendors":["Anyscale","Ray"],"content_html":"\u003cp\u003eRay prior to 2.56.0 contains an unsafe deserialization vulnerability (CVE-2026-57516) in its WebDataset reader. This flaw, affecting the \u003ccode\u003e_default_decoder()\u003c/code\u003e function within \u003ccode\u003ewebdataset_datasource.py\u003c/code\u003e, allows remote attackers to achieve arbitrary code execution on Ray remote workers. The vulnerability is triggered by an attacker supplying a specially crafted malicious tar archive to the \u003ccode\u003eread_webdataset()\u003c/code\u003e function. When processing this archive, the \u003ccode\u003e_default_decoder()\u003c/code\u003e unconditionally calls \u003ccode\u003epickle.loads()\u003c/code\u003e on entries with \u003ccode\u003e.pkl\u003c/code\u003e or \u003ccode\u003e.pickle\u003c/code\u003e extensions, or \u003ccode\u003etorch.load()\u003c/code\u003e with \u003ccode\u003eweights_only=False\u003c/code\u003e on \u003ccode\u003e.pt\u003c/code\u003e or \u003ccode\u003e.pth\u003c/code\u003e entries. This deserialization process executes arbitrary Python code, leading to RCE across any Ray worker processing the malicious data. This vulnerability affects all Ray deployments prior to version 2.56.0.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker crafts a malicious tar archive containing a \u003ccode\u003e.pkl\u003c/code\u003e, \u003ccode\u003e.pickle\u003c/code\u003e, \u003ccode\u003e.pt\u003c/code\u003e, or \u003ccode\u003e.pth\u003c/code\u003e file embedded with arbitrary Python code.\u003c/li\u003e\n\u003cli\u003eThe attacker identifies a Ray deployment running a vulnerable version (prior to 2.56.0) that can be induced to load external data.\u003c/li\u003e\n\u003cli\u003eThe attacker supplies the malicious tar archive to a Ray application or service that utilizes the \u003ccode\u003eread_webdataset()\u003c/code\u003e function.\u003c/li\u003e\n\u003cli\u003eA Ray remote worker attempts to process the supplied tar archive through its WebDataset reader.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003e_default_decoder()\u003c/code\u003e function in \u003ccode\u003ewebdataset_datasource.py\u003c/code\u003e identifies the malicious file entry (e.g., \u003ccode\u003e.pkl\u003c/code\u003e) within the archive.\u003c/li\u003e\n\u003cli\u003eThe function unconditionally calls \u003ccode\u003epickle.loads()\u003c/code\u003e (or \u003ccode\u003etorch.load()\u003c/code\u003e for \u003ccode\u003e.pt/.pth\u003c/code\u003e) on the malicious entry, causing the embedded arbitrary Python code to execute within the Ray worker's context.\u003c/li\u003e\n\u003cli\u003eThe execution of arbitrary code results in remote code execution (RCE) on the compromised Ray remote worker, potentially leading to system compromise or data exfiltration.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-57516 allows remote attackers to execute arbitrary code with the privileges of the Ray remote worker process. This can lead to full compromise of the affected worker, potential access to sensitive data processed by Ray, disruption of Ray clusters, or lateral movement within the compromised environment. While no specific victim counts or targeted sectors are currently available, any organization utilizing Ray prior to version 2.56.0 and processing untrusted data through the WebDataset reader is at risk.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch CVE-2026-57516 by upgrading Ray to version 2.56.0 or later immediately.\u003c/li\u003e\n\u003cli\u003eImplement strict input validation and sanitization for all data supplied to \u003ccode\u003eread_webdataset()\u003c/code\u003e functions, particularly for tar archives from untrusted sources, to prevent the ingestion of malicious content.\u003c/li\u003e\n\u003cli\u003eRestrict network access to Ray clusters and remote workers to only trusted entities and services to minimize the attack surface.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-24T15:49:40Z","date_published":"2026-07-01T17:40:30Z","id":"https://feed.craftedsignal.io/briefs/2026-07-cve-2026-57516-ray-deserialization-rce/","summary":"An unsafe deserialization vulnerability (CVE-2026-57516) exists in the WebDataset reader of the Ray framework prior to version 2.56.0, allowing remote attackers to achieve arbitrary code execution on Ray remote workers by supplying a malicious tar archive to the `read_webdataset()` function, which then unconditionally calls `pickle.loads()` on .pkl/.pickle entries or `torch.load()` with `weights_only=False` on .pt/.pth entries, executing arbitrary code.","title":"CVE-2026-57516: Ray Unsafe Deserialization Leading to RCE","url":"https://feed.craftedsignal.io/briefs/2026-07-cve-2026-57516-ray-deserialization-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:anyscale:ray:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}