PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-41486 ray-project CVE debrief

Ray Data in versions 2.54.0 through 2.54.x registers custom PyArrow extension types globally. When PyArrow parses a Parquet file schema containing these extension types, the `__arrow_ext_deserialize__` method passes metadata bytes directly to `cloudpickle.loads()`, enabling arbitrary code execution during schema parsing before any row data is read. This deserialization of untrusted data (CWE-502) allows code injection (CWE-94) with attacker-controlled Parquet files. The vulnerability is remotely exploitable when victims open malicious Parquet files. Anyscale patched this in Ray 2.55.0 by modifying the deserialization logic. No CISA KEV listing exists. Organizations using Ray 2.54.0 for data processing should prioritize upgrading, especially in environments where Parquet files from external or untrusted sources are ingested.

Vendor
ray-project
Product
ray
CVSS
HIGH 8.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-08
Original CVE updated
2026-05-18
Advisory published
2026-05-08
Advisory updated
2026-05-18

Who should care

Organizations running Ray 2.54.0 for distributed data processing, particularly those ingesting Parquet files from external sources, untrusted data pipelines, or multi-tenant environments where users can supply data files. Data engineers, ML platform teams, and security operations centers managing Ray deployments should prioritize this patch.

Technical summary

Ray Data versions 2.54.0 to before 2.55.0 register custom Arrow extension types that deserialize metadata using cloudpickle.loads() without validation. When PyArrow reads a Parquet file with these extension types, attacker-controlled metadata triggers arbitrary code execution during schema parsing. The vulnerability requires user interaction to open a malicious file but achieves high impact across confidentiality, integrity, and availability. Patch commit c02bd31ae31996805868baa446a131a8d304525f removes the unsafe deserialization.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade Ray to version 2.55.0 or later to eliminate the vulnerable deserialization path
  • If immediate patching is not feasible, restrict ingestion of Parquet files to trusted sources only and implement pre-processing validation
  • Audit systems for Ray 2.54.0 installations, particularly in data pipelines processing external Parquet data
  • Monitor for anomalous process execution during Parquet schema parsing operations
  • Review access controls on data lake and object storage repositories containing Parquet files to prevent unauthorized file placement

Evidence notes

Vulnerability confirmed in Ray 2.54.0; patched in 2.55.0. CVSS 4.0 vector indicates network attack vector with low attack complexity, attacker privileges none, user interaction required, high impact across confidentiality, integrity, and availability for both victim and subsequent systems. Weaknesses identified as CWE-94 (Improper Control of Generation of Code) and CWE-502 (Deserialization of Untrusted Data).

Sources and references

Verified primary and authoritative sources

  • CVE-2026-41486 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-41486

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-41486 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-41486

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.