CVE-2026-57516 Anyscale, Inc CVE debrief

Who should care

Defenders responsible for Ray deployments should assess exposure and prioritize upgrading to 2.56.0 or later. They should also review and restrict usage of the WebDataset reader, implement additional security measures to prevent deserialization attacks, and verify Ray versions.

Why it matters

Defenders should prioritize verifying Ray versions and upgrading to 2.56.0 or later to prevent remote code execution via deserialization attacks.

• Remote code execution is possible via malicious tar archives
• Deserialization attacks can be prevented with proper security measures
• Verification of Ray versions and upgrades is necessary

Technical summary

The CVE record describes an unsafe deserialization vulnerability in Ray's WebDataset reader, which allows attackers to achieve remote code execution by supplying a malicious tar archive to the read_webdataset() function. The _default_decoder() function in webdataset_datasource.py unconditionally calls pickle.loads() on tar entries with .pkl/.pickle extensions and torch.load() with weights_only=False on .pt/.pth entries, executing arbitrary code inside Ray remote workers on every worker that processes the malicious archive. This vulnerability can be prevented with proper security measures

Defensive priority

Defenders should prioritize verifying Ray versions and upgrading to 2.56.0 or later.

Recommended defensive actions

• Verify Ray versions and upgrade to 2.56.0 or later
• Review and restrict usage of the WebDataset reader
• Implement additional security measures to prevent deserialization attacks
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance

Evidence notes

The CVE record and source item provide details on the unsafe deserialization vulnerability in Ray's WebDataset reader. The vulnerability is caused by the _default_decoder() function in webdataset_datasource.py, which unconditionally calls pickle.loads() on tar entries with .pkl/.pickle extensions and torch.load() with weights_only=False on .pt/.pth entries. This allows attackers to achieve remote code execution by supplying a malicious tar archive to the read_webdataset() function. Defenders should verify Ray versions and upgrade to 2

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.