Ray: Remote Code Execution via Parquet Arrow Extension Type Deserialization
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Active
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 3 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-502.
Summary
Ray is an AI compute engine. From version 2.54.0 to before version 2.55.0, Ray Data registers custom Arrow extension types (ray.data.arrow_tensor, ray.data.arrow_tensor_v2, ray.data.arrow_variable_shaped_tensor) globally in PyArrow. When PyArrow reads a Parquet file containing one of these extension types, it calls __arrow_ext_deserialize__ on the field's metadata bytes. Ray's implementation passes these bytes directly to cloudpickle.loads(), achieving arbitrary code execution during schema parsing, before any row data is read. This issue has been patched in version 2.55.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Ray-Project | ray | 2.54.0 to before 2.55.0 | 2.55.0 | Patch available | CNA |
| — | ray (PyPI) | 2.49.0 to before 2.55.0 | 2.55.0 | Patch available | GHSA-mw35-8rx3-xf9r |
- ray VendorRay-Project Affected 2.54.0 to before 2.55.0 Fixed in 2.55.0 Patch available CNA
- ray (PyPI) Vendor— Affected 2.49.0 to before 2.55.0 Fixed in 2.55.0 Patch available GHSA-mw35-8rx3-xf9r
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:anyscale:ray:2.54.0:*:*:*:*:*:*:* | 2.54.0 | Vulnerable | Anyscale, Inc |
- cpe:2.3:a:anyscale:ray:2.54.0:*:*:*:*:*:*:* Versions 2.54.0 Vulnerable ·Anyscale, Inc
Remediation
- Fix · CNA ray (ray-project) Fixed in 2.55.0
- Fix · GHSA-mw35-8rx3-xf9r ray (PyPI) Fixed in 2.55.0 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat AI Inference Server | Affected | — |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | — |
| Red Hat OpenShift AI (RHOAI) | Affected | — |
Timeline
- 2026-10-02 Threatist record created from CVE-2026-41486
- 2026-10-03 Alias added: GHSA-mw35-8rx3-xf9r
- 2026-10-25 EPSS moved to the below the 50th percentile
- 2026-11-06 Affected versions changed · Red Hat
- 2026-11-06 CVSS score added · Red Hat
References
Patch 2
Advisory 2
More Ray-Project vulnerabilities
- TI-2025-38808 Ray is vulnerable to RCE via Safari & Firefox Browsers through DNS Rebinding Attack KEVCVSS 4.0CRITICAL 9.4
- TI-2023-05545 Ray Command Injection in cpu_profile Parameter CVSS 3.1CRITICAL 9.8
- TI-2026-25429 Ray Dashboard <= 2.8.0 Path Traversal Leading to Local File Disclosure CVSS 4.0HIGH 8.7
- TI-2023-05547 Ray Log File Local File Include CVSS 3.1HIGH 7.5
- TI-2026-21889 Ray: Dashboard DELETE endpoints allow unauthenticated browser-triggered DoS (Serve shutdown / job deletion) CVSS 3.1MEDIUM 6.5
- TI-2023-05546 Ray Static File Local File Include CVSS 3.1HIGH 7.5
Sources
- CVE-2026-41486 · CVE Program
- CVE-2026-41486 · NVD
- FIRST EPSS
- GHSA-mw35-8rx3-xf9r · GitHub Advisory Database · CC BY 4.0
- CVE-2026-41486 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences