CVE-2026-57516: Ray WebDataset Remote Code Execution via Unsafe Deserialization

Technical summary

The vulnerability stems from unsafe deserialization in the WebDataset reader component (webdataset_datasource.py). The _default_decoder() function unconditionally calls pickle.loads() on files matching .pkl and .pickle extensions, and torch.load() with weights_only=False on .pt and .pth files. Neither deserialization operation validates or sanitizes the data before execution. Because pickle and PyTorch's load function with weights_only=False can instantiate arbitrary Python objects during deserialization, an attacker-controlled archive effectively becomes a vehicle for remote code execution. Ray's distributed nature means the exploit payload executes in the context of every worker process that reads the malicious archive, multiplying the attack surface and impact.

Business impact

Compromise of Ray clusters can lead to complete loss of confidentiality, integrity, and availability of distributed workloads. An attacker gaining code execution across worker nodes can steal training data, model parameters, or intermediate computation results; inject false data or poisoned models; disrupt batch processing, machine learning pipelines, or real-time inference; or pivot to other systems on your network. Organizations running Ray for ML training, data processing, or analytics face potential data theft, IP loss, operational downtime, and regulatory compliance violations if sensitive data is involved.

Affected systems

All Ray installations prior to version 2.56.0 are affected. The vulnerability is triggered specifically when the read_webdataset() function is called with untrusted tar archives. Any deployment using Ray's WebDataset reader for local or remote dataset ingestion is at risk. This includes ML training pipelines, batch data processing workflows, and any distributed application that accepts external tar-based datasets.

Exploitability

Exploitation requires user interaction in the sense that the vulnerable read_webdataset() function must be invoked with an attacker-supplied archive. However, the barrier to entry is low: an attacker need only craft a tar file containing a malicious pickle or PyTorch file and make it available to the target (via download, API upload, or network share). No special privileges, authentication, or complex setup is required. The CVSS vector reflects network accessibility, low complexity, and no privileges needed. If datasets are sourced from untrusted or insufficiently validated sources, exploitation is straightforward.

Remediation

Upgrade Ray to version 2.56.0 or later immediately. This version patches the unsafe deserialization by implementing proper validation and secure deserialization practices for WebDataset entries. Verify the upgrade is complete across all worker nodes and driver processes in your cluster. In addition, implement network segmentation and access controls to limit which sources can supply datasets to Ray, and validate the integrity and origin of tar archives before processing.

Patch guidance

Apply Ray 2.56.0 as soon as testing permits. Verify that all Ray processes—both drivers and workers—are running the patched version by checking version output and restarting the cluster if necessary. Test your existing WebDataset workflows after upgrade to ensure compatibility. If you are on a version prior to 2.56.0, prioritize this upgrade in your maintenance window; there is no known workaround beyond upgrading or disabling WebDataset functionality.

Detection guidance

Monitor Ray worker logs and system execution traces for unexpected pickle or torch.load() deserialization of external tar entries. Look for process spawns or system calls from Ray worker processes that do not align with your normal workload patterns. Network-based detection is limited; focus on host-level anomaly detection around Ray worker processes. Query your dataset provenance and access logs to identify whether untrusted or external tar archives have been supplied to read_webdataset(). Implement file integrity monitoring on stored datasets to detect tampering.

Why prioritize this

This vulnerability scores 8.8 (HIGH) due to network-accessible attack vector, no authentication requirement, and severe impact (arbitrary code execution on every worker). Although exploitation requires dataset supply (not purely unauthenticated network attack), the combination of ease of exploitation, cluster-wide impact, and high likelihood of data/IP loss makes this a top-tier priority. Any organization running Ray in production should treat this as critical.

Risk score, explained

CVSS 8.8 reflects: (1) Network vector—datasets can be supplied remotely; (2) Low complexity—no advanced exploitation technique needed, just a crafted tar file; (3) No privileges or user interaction paradoxically rated; (4) High confidentiality, integrity, and availability impact—code execution on workers leads to data theft, system compromise, and service disruption. The score appropriately signals severe risk for Ray deployments that accept external datasets.

Frequently asked questions