CVE-2026-57516 Ray < 2.56.0 Unsafe Deserialization RCE via WebDataset Reader
Attackers can achieve remote code execution in Ray workers by supplying a malicious tar archive to the WebDataset reader due to unsafe deserialization.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-57516?
CVE-2026-57516 is a high-severity unsafe deserialization vulnerability in Anyscale, Inc Ray, published on 1 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Ray prior to 2.56.0 contains an unsafe deserialization vulnerability in the WebDataset reader that allows attackers to achieve remote code execution by supplying a malicious tar archive to the read_webdataset() function. The _default_decoder() function in webdataset_datasource.py unconditionally calls pickle.loads() on tar entries with .pkl/.pickle extensions and torch.load() with weights_only=False on .pt/.pth entries, executing arbitrary code inside Ray remote workers on every worker that processes the malicious archive.
Weakness: CWE-502
Which versions are affected by CVE-2026-57516?
3 open source packages ship an affected version, including ray. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
ray PyPI | All versions | 2.56.0 |
ray PyPI | All versions | 2.56.0 |
ray PyPI | All versions | 2.56.0 |
Products include Anyscale Ray.
How do I fix CVE-2026-57516?
Upgrade ray to 2.56.0 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-57516 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-57516 exists.
Other vulnerabilities in Anyscale, Inc Ray
- CVE-2025-62593 Ray-Project Ray Code Injection
- CVE-2023-48022 Ray has arbitrary code execution via jobs submission API
- CVE-2023-48023 Server-side request forgery in n/a
- CVE-2026-41486 Ray: Remote Code Execution via Parquet Arrow Extension Type Deserialization
- CVE-2026-32981 Ray Dashboard <= 2.8.0 Path Traversal Leading to Local File Disclosure
Sources
Also known as ECHO-d8c2-64e4-5430, GHSA-hhrp-gw25-jr43, MINI-5jcp-mc9j-7799, MINI-f4wf-33fg-rvv4, PYSEC-2026-2273.