CVE-2026-32981 Ray Dashboard <= 2.8.0 Path Traversal Leading to Local File Disclosure

What is CVE-2026-32981?

CVE-2026-32981 is a high-severity path traversal vulnerability in ray-project Ray, published on 17 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A path traversal vulnerability was identified in Ray Dashboard (default port 8265) in Ray versions prior to 2.8.1. Due to improper validation and sanitization of user-supplied paths in the static file handling mechanism, an attacker can use traversal sequences (e.g., ../) to access files outside the intended static directory, resulting in local file disclosure.

Weakness: CWE-22

Which versions are affected by CVE-2026-32981?

3 open source packages ship an affected version, including ray. It affects 1 product.

Products include Anyscale Ray.

How do I fix CVE-2026-32981?

Upgrade ray to 2.8.1 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2026-32981 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-32981 exists.

Other vulnerabilities in ray-project Ray

• CVE-2025-62593 Ray-Project Ray Code Injection Exploited Critical 9.4
• CVE-2023-48022 Ray has arbitrary code execution via jobs submission API Critical 9.8
• CVE-2023-48023 Server-side request forgery in n/a Critical 9.1
• CVE-2026-41486 Ray: Remote Code Execution via Parquet Arrow Extension Type Deserialization High 8.9
• CVE-2026-57516 Ray < 2.56.0 Unsafe Deserialization RCE via WebDataset Reader High 8.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-j3mh-qmjj-xp83, PYSEC-2026-130.