PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-41486 ray-project CVE debrief

Ray Data in versions 2.54.0 through 2.54.x registers custom PyArrow extension types globally. When PyArrow parses a Parquet file schema containing these extension types, the `__arrow_ext_deserialize__` method passes metadata bytes directly to `cloudpickle.loads()`, enabling arbitrary code execution during schema parsing before any row data is read. This deserialization of untrusted data (CWE-502) allows code injection (CWE-94) with attacker-controlled Parquet files. The vulnerability is remotely exploitable when victims open malicious Parquet files. Anyscale patched this in Ray 2.55.0 by modifying the deserialization logic. No CISA KEV listing exists. Organizations using Ray 2.54.0 for data processing should prioritize upgrading, especially in environments where Parquet files from external or untrusted sources are ingested.

Vendor
ray-project
Product
ray
CVSS
HIGH 8.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-08
Original CVE updated
2026-05-18
Advisory published
2026-05-08
Advisory updated
2026-05-18

Who should care

Organizations running Ray 2.54.0 for distributed data processing, particularly those ingesting Parquet files from external sources, untrusted data pipelines, or multi-tenant environments where users can supply data files. Data engineers, ML platform teams, and security operations centers managing Ray deployments should prioritize this patch.

Technical summary

Ray Data versions 2.54.0 to before 2.55.0 register custom Arrow extension types that deserialize metadata using cloudpickle.loads() without validation. When PyArrow reads a Parquet file with these extension types, attacker-controlled metadata triggers arbitrary code execution during schema parsing. The vulnerability requires user interaction to open a malicious file but achieves high impact across confidentiality, integrity, and availability. Patch commit c02bd31ae31996805868baa446a131a8d304525f removes the unsafe deserialization.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade Ray to version 2.55.0 or later to eliminate the vulnerable deserialization path
  • If immediate patching is not feasible, restrict ingestion of Parquet files to trusted sources only and implement pre-processing validation
  • Audit systems for Ray 2.54.0 installations, particularly in data pipelines processing external Parquet data
  • Monitor for anomalous process execution during Parquet schema parsing operations
  • Review access controls on data lake and object storage repositories containing Parquet files to prevent unauthorized file placement

Evidence notes

Vulnerability confirmed in Ray 2.54.0; patched in 2.55.0. CVSS 4.0 vector indicates network attack vector with low attack complexity, attacker privileges none, user interaction required, high impact across confidentiality, integrity, and availability for both victim and subsequent systems. Weaknesses identified as CWE-94 (Improper Control of Generation of Code) and CWE-502 (Deserialization of Untrusted Data).

Official resources

2026-05-08