Attack Chain

1. Attacker crafts a malicious tar archive containing a .pkl, .pickle, .pt, or .pth file embedded with arbitrary Python code.
2. The attacker identifies a Ray deployment running a vulnerable version (prior to 2.56.0) that can be induced to load external data.
3. The attacker supplies the malicious tar archive to a Ray application or service that utilizes the read_webdataset() function.
4. A Ray remote worker attempts to process the supplied tar archive through its WebDataset reader.
5. The _default_decoder() function in webdataset_datasource.py identifies the malicious file entry (e.g., .pkl) within the archive.
6. The function unconditionally calls pickle.loads() (or torch.load() for .pt/.pth) on the malicious entry, causing the embedded arbitrary Python code to execute within the Ray worker's context.
7. The execution of arbitrary code results in remote code execution (RCE) on the compromised Ray remote worker, potentially leading to system compromise or data exfiltration.

Impact

Successful exploitation of CVE-2026-57516 allows remote attackers to execute arbitrary code with the privileges of the Ray remote worker process. This can lead to full compromise of the affected worker, potential access to sensitive data processed by Ray, disruption of Ray clusters, or lateral movement within the compromised environment. While no specific victim counts or targeted sectors are currently available, any organization utilizing Ray prior to version 2.56.0 and processing untrusted data through the WebDataset reader is at risk.

Recommendation

• Patch CVE-2026-57516 by upgrading Ray to version 2.56.0 or later immediately.
• Implement strict input validation and sanitization for all data supplied to read_webdataset() functions, particularly for tar archives from untrusted sources, to prevent the ingestion of malicious content.
• Restrict network access to Ray clusters and remote workers to only trusted entities and services to minimize the attack surface.