Ray-project Ray vulnerabilities

• anyscale ray Ray < 2.56.0 Unsafe Deserialization RCE via WebDataset Reader CVE-2026-57516 Fix available 8.6 HighJuly 1, 2026
• anyscale ray Ray: Remote Code Execution via Parquet Arrow Extension Type Deserialization CVE-2026-41486 Fix available 8.9 HighApril 24, 2026
• anyscale ray, red hat ai inference server 3.2, enterprise linux ai (rhel ai) 3 +3 more +5 more Ray Dashboard <= 2.8.0 Path Traversal Leading to Local File Disclosure CVE-2026-32981 Fix available 8.7 HighMarch 17, 2026
• anyscale ray Ray: Dashboard DELETE endpoints allow unauthenticated browser-triggered DoS (Serve shutdown / job deletion) CVE-2026-27482 Fix available 5.9 MediumFebruary 20, 2026
• anyscale ray Ray is vulnerable to RCE via Safari & Firefox Browsers through DNS Rebinding Attack CVE-2025-62593 In KEVPublic exploitFix available EPSS 60.2% 9.4 CriticalNovember 26, 2025
• ray-project ray ray vulnerable to Insertion of Sensitive Information into Log File CVE-2025-1979 Fix available 5.7 MediumMarch 6, 2025
• ray project ray, ray-project ray-project/ray +1 more Ray Static File Local File Include CVE-2023-6020 Fix available EPSS 14.7% 7.5 HighNovember 16, 2023
• ray project ray, ray-project ray-project/ray +1 more Ray Command Injection in cpu_profile Parameter CVE-2023-6019 Public exploitFix available EPSS 74.6% 9.8 CriticalNovember 16, 2023
• ray project ray, ray-project ray-project/ray +1 more Ray Log File Local File Include CVE-2023-6021 Fix available EPSS 37.1% 7.5 HighNovember 16, 2023