CVE-2026-32981 ray-project CVE debrief

Who should care

Organizations using Ray versions prior to 2.8.1 should be aware of this vulnerability and take necessary actions to mitigate the risk. Specifically, administrators and security teams responsible for Ray installations should review their configurations and update to version 2.8.1 or later. Additionally, users of Ray Dashboard should be cautious when accessing files and directories.

Technical summary

The path traversal vulnerability in Ray Dashboard occurs due to improper validation and sanitization of user-supplied paths in the static file handling mechanism. An attacker can exploit this vulnerability by using traversal sequences (e.g., ../) to access files outside the intended static directory, leading to local file disclosure. The vulnerability has a CVSS score of 8.7 and is considered HIGH severity. The affected product is Ray, and the vendor is Anyscale.

Defensive priority

High priority should be given to updating Ray to version 2.8.1 or later. In the meantime, defenders should monitor Ray Dashboard access and restrict access to sensitive files and directories.

Recommended defensive actions

• Update Ray to version 2.8.1 or later
• Monitor Ray Dashboard access and restrict access to sensitive files and directories
• Review and restrict access to Ray Dashboard (default port 8265)
• Implement additional security measures to detect and prevent local file disclosure attempts
• Conduct regular security audits and vulnerability assessments

Evidence notes

The CVE record and NVD detail provide official information about the vulnerability. Additional sources, including Vulncheck and Red Hat, offer advisories and mitigation guidance. The vulnerability is tracked under CWE-22.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.