CVE-2026-41486 Ray: Remote Code Execution via Parquet Arrow Extension Type Deserialization
Attackers can achieve arbitrary code execution by tricking users into opening malicious Parquet files with Ray Data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-41486?
CVE-2026-41486 is a high-severity unsafe deserialization vulnerability in ray-project ray, published on 8 May 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Ray is an AI compute engine. From version 2.54.0 to before version 2.55.0, Ray Data registers custom Arrow extension types (ray.data.arrow_tensor, ray.data.arrow_tensor_v2, ray.data.arrow_variable_shaped_tensor) globally in PyArrow. When PyArrow reads a Parquet file containing one of these extension types, it calls __arrow_ext_deserialize__ on the field's metadata bytes. Ray's implementation passes these bytes directly to cloudpickle.loads(), achieving arbitrary code execution during schema parsing, before any row data is read. This issue has been patched in version 2.55.0.
Which versions are affected by CVE-2026-41486?
4 open source packages ship an affected version, including ray and ve-ray. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
ray PyPI | All versions to 2.54.0 | None |
ray PyPI | From 2.49.0 | 2.55.0 |
ray PyPI | From 2.49.0 | 2.55.0 |
ve-ray PyPI | All versions to 2.54.0 | None |
Products include Anyscale Ray.
How do I fix CVE-2026-41486?
Upgrade ray to 2.55.0 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-41486 being exploited?
There is no known exploitation of CVE-2026-41486 in the wild and no public exploit code.
Other vulnerabilities in ray-project ray
- CVE-2025-62593 Ray-Project Ray Code Injection
- CVE-2023-48022 Ray has arbitrary code execution via jobs submission API
- CVE-2023-48023 Server-side request forgery in n/a
- CVE-2026-32981 Ray Dashboard <= 2.8.0 Path Traversal Leading to Local File Disclosure
- CVE-2026-57516 Ray < 2.56.0 Unsafe Deserialization RCE via WebDataset Reader
Sources
Also known as ECHO-e817-9967-6723, GHSA-mw35-8rx3-xf9r, MINI-pg3w-2mjx-wvqm, MINI-r4vv-2xhq-5x55, PYSEC-2026-2272, PYSEC-2026-2296.