CVE-2026-104989: V-Ray Swarm: search path flaw allows unauthenticated RCE

CRITICAL

Published November 9, 2026

CISO Take

V-Ray Swarm, Chaos Software's distributed rendering component, has an uncontrolled search path flaw (CWE-427) in its package upload feature. A remote, unauthenticated attacker can redirect library loading and execute arbitrary code on the host. NVD rates it critical, but CVSS, EPSS and SSVC data are not yet published. It is not in CISA KEV and no public exploit or Nuclei template is known, so exploitation today looks unlikely but not ruled out. Mandiant has published a third-party advisory (MNDT-2026-0043), which usually makes reproduction easier. The package has 637 downstream dependents, an OpenSSF Scorecard of 5.7/10 and 21 other CVEs, so it carries real supply-chain exposure for render and GPU farms. Upgrade to the fixed release referenced in the vendor notes (2.0.21 or later) and make sure Swarm nodes are not reachable from untrusted networks.

Sources:NVDATLASOpenSSFMandiant Vulnerability Disclosuresdocumentation.chaos.com

What is the risk?

Risk is high, pending scoring data. The attack is remote and unauthenticated with a code execution outcome, which is the worst case for a network service. Exploitation signals are weak: no KEV listing, no public exploit, no scanner template and no EPSS score yet. A Mandiant write-up exists and the package has 21 prior CVEs, which suggests researchers are paying attention. Exposure depends on whether the Swarm listener is reachable beyond a trusted render network. Treat internet-exposed instances as critical and isolated internal instances as high.

How does the attack unfold?

Initial Access

The attacker reaches an exposed V-Ray Swarm service and uses the unauthenticated package upload feature.

AML.T0049

Exploitation

A malicious library is placed in an uncontrolled search path and loaded by the service, causing arbitrary code execution (CWE-427).

AML.T0010.001

Lateral Movement

The attacker uses the compromised node's credentials and network access to reach shared storage and ML ops systems.

Impact

The attacker gains full control of the compute host, with the potential to steal data and artifacts or tamper with rendering and dataset outputs.

Initial Access

The attacker reaches an exposed V-Ray Swarm service and uses the unauthenticated package upload feature.

AML.T0049

Exploitation

A malicious library is placed in an uncontrolled search path and loaded by the service, causing arbitrary code execution (CWE-427).

AML.T0010.001

Lateral Movement

The attacker uses the compromised node's credentials and network access to reach shared storage and ML ops systems.

Impact

The attacker gains full control of the compute host, with the potential to steal data and artifacts or tamper with rendering and dataset outputs.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Ray	pip	—	No patch
44.2KOpenSSF 5.7637 dependentsPushed 5d ago59% patched~174d to patchFull package profile →

Do you use Ray? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.6%

chance of exploitation in 30 days

Higher than 49% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What should I do?

6 steps

Upgrade V-Ray Swarm to 2.0.21 or later, as indicated by the vendor release notes, and confirm the fixed version against the Mandiant advisory MNDT-2026-0043.
Until patched, block external access to Swarm service ports with firewall rules and allow only known render controller IPs.
Disable or restrict the package upload feature if the configuration allows it.
Run Swarm under a least-privilege service account and keep it off hosts that hold ML credentials or model artifacts.
Detect abuse by monitoring for unexpected DLL or shared library loads from upload or temp directories, unusual child processes spawned by the Swarm service, and unsolicited inbound upload requests.
Inventory pip-installed V-Ray Swarm across build and render fleets and track vendor updates.

How is it classified?

Code ExecutionSupply ChainFrameworkAML.T0010.001- AI Software AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responses to previously unknown risks and mechanisms to supersede or deactivate AI systems

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-104989?

Is CVE-2026-104989 actively exploited?

No confirmed active exploitation of CVE-2026-104989 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-104989?

1. Upgrade V-Ray Swarm to 2.0.21 or later, as indicated by the vendor release notes, and confirm the fixed version against the Mandiant advisory MNDT-2026-0043. 2. Until patched, block external access to Swarm service ports with firewall rules and allow only known render controller IPs. 3. Disable or restrict the package upload feature if the configuration allows it. 4. Run Swarm under a least-privilege service account and keep it off hosts that hold ML credentials or model artifacts. 5. Detect abuse by monitoring for unexpected DLL or shared library loads from upload or temp directories, unusual child processes spawned by the Swarm service, and unsolicited inbound upload requests. 6. Inventory pip-installed V-Ray Swarm across build and render fleets and track vendor updates.

What systems are affected by CVE-2026-104989?

This vulnerability affects the following AI/ML architecture patterns: distributed rendering clusters, GPU compute farms, synthetic data generation pipelines, ML ops build and artifact infrastructure.

What is the CVSS score for CVE-2026-104989?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

distributed rendering clustersGPU compute farmssynthetic data generation pipelinesML ops build and artifact infrastructure

MITRE ATLAS Techniques

AML.T0010.001AI Software

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

Uncontrolled search path element in package upload feature in Chaos Software V-Ray versions through 2.0.19 allows remote unauthenticated attackers to execute arbitrary code via redirecting access to libraries

Exploitation Scenario

An attacker scans for a reachable V-Ray Swarm service on a studio or ML rendering cluster. They send a crafted package upload that places a malicious library in a location the service searches before the legitimate one. When the service loads the library, it runs the attacker's code with the service's privileges. From the compromised GPU node, the attacker steals credentials and cloud tokens, reads shared datasets and model artifacts, and moves laterally to MLOps infrastructure. They may also deploy persistence or cryptominers on the GPU capacity.

Weaknesses (CWE)

CWE-427Uncontrolled Search Path Element

CWE-427 — Uncontrolled Search Path Element: The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.

[Architecture and Design, Implementation] Hard-code the search path to a set of known-safe values (such as system directories), or only allow them to be specified by the administrator in a configuration file. Do not allow these settings to be modified by an external party. Be careful to avoid related weaknesses such as CWE-426 and CWE-428.
[Implementation] When invoking other programs, specify those programs using fully-qualified pathnames. While this is an effective approach, code that uses fully-qualified pathnames might not be portable to other systems that do not use the same pathnames. The portability can be improved by locating the full-qualified paths in a centralized, easily-modifiable location within the source code, and having the code refer to these paths.

Source: MITRE CWE corpus.