CVE-2026-57516: Ray RCE — HIGH

CISO Take

Ray's WebDataset reader blindly deserializes tar archive contents with pickle.loads() and torch.load(weights_only=False), so any tar file fed into read_webdataset() can execute arbitrary code on every Ray worker that processes it — a classic pickle/PyTorch RCE pattern (CWE-502) landing in a distributed compute framework rather than a single host. Ray underpins training and data-preprocessing pipelines at scale, so one malicious dataset shard pulled from a shared bucket, a public dataset mirror, or an untrusted collaborator can pivot into code execution across an entire worker fleet, not just one machine. There's no CISA KEV listing, no public exploit, and no EPSS score yet, so this hasn't been weaponized in the wild, but the trigger condition — pointing read_webdataset() at a crafted tar, no auth or elevated privileges needed — is a routine action in ML data-loading workflows. Upgrade to Ray 2.56.0 immediately, and until every worker is patched, treat WebDataset inputs as untrusted: restrict read_webdataset() to vetted internal sources and monitor Ray worker processes for unexpected pickle/torch.load activity or outbound connections.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

CVSS 8.8 (network, low complexity, no privileges, high confidentiality/integrity/availability impact) reflects a severe technical vulnerability, tempered only by the required user interaction (a pipeline must actually load the malicious archive). In practice that bar is low: dataset ingestion is a routine, often automated step in ML pipelines, and WebDataset-format tar shards are commonly sourced from shared storage, third-party mirrors, or collaborators outside the security team's direct control. No active exploitation or public PoC exists today, but the vulnerability class (unsafe pickle/torch.load deserialization) is extremely well understood by attackers and trivially weaponizable once a target's ingestion path is known. Organizations running Ray clusters for training or large-scale data processing that ingest WebDataset shards from anything less than a fully trusted, access-controlled source face material exposure.

How does the attack unfold?

Malicious dataset delivery

Attacker plants a poisoned WebDataset tar shard containing malicious .pkl or .pt/.pth entries in a location the target will ingest (public mirror, shared bucket, collaborator dataset).

AML.T0010.002

Untrusted deserialization triggers RCE

Victim's Ray pipeline calls read_webdataset() on the shard; _default_decoder() unconditionally runs pickle.loads()/torch.load() on the payload, executing arbitrary code.

AML.T0011.000

Cluster-wide worker compromise

Every Ray worker assigned to process the shard executes the payload, giving the attacker footholds across multiple nodes in the distributed cluster simultaneously.

AML.T0112

Credential and data impact

Attacker leverages compromised workers' attached cloud credentials and access to exfiltrate data, steal models, or pivot further into the environment.

AML.T0025

Malicious dataset delivery

Attacker plants a poisoned WebDataset tar shard containing malicious .pkl or .pt/.pth entries in a location the target will ingest (public mirror, shared bucket, collaborator dataset).

AML.T0010.002

Untrusted deserialization triggers RCE

Victim's Ray pipeline calls read_webdataset() on the shard; _default_decoder() unconditionally runs pickle.loads()/torch.load() on the payload, executing arbitrary code.

AML.T0011.000

Cluster-wide worker compromise

Every Ray worker assigned to process the shard executes the payload, giving the attacker footholds across multiple nodes in the distributed cluster simultaneously.

AML.T0112

Credential and data impact

Attacker leverages compromised workers' attached cloud credentials and access to exfiltrate data, steal models, or pivot further into the environment.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Ray	pip	< 2.56.0	`2.56.0`
43.5K OpenSSF 5.8 620 dependents Pushed 2d ago 68% patched ~132d to patch Full package profile →

Do you use Ray? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.6%

chance of exploitation in 30 days

Higher than 44% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI Required

S Unchanged

C High

I High

A High

What should I do?

1 step

Upgrade to Ray >= 2.56.0, which removes the unconditional pickle.loads()/torch.load(weights_only=False) calls in webdataset_datasource.py. Until patched, do not call read_webdataset() on tar archives from external, shared, or otherwise untrusted sources — restrict ingestion to vetted internal buckets with strict access control. Scan .pkl/.pickle members with a tool like picklescan before ingestion, and avoid torch.load() on .pt/.pth files without weights_only=True. Harden worker isolation (no cloud metadata endpoint access, restricted egress, minimal IAM scope) so a single-worker compromise doesn't cascade into cluster-wide or cloud-wide compromise. Monitor Ray worker processes for anomalous pickle/torch.load invocations, unexpected subprocess spawns, or outbound network connections correlated with dataset ingestion jobs.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Supply Chain Code Execution Training Data Framework AML.T0010.002 - Data AML.T0011 - User Execution AML.T0011.000 - Unsafe AI Artifacts AML.T0018.002 - Embed Malware

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

Annex A.7 - Data for AI systems

NIST AI RMF

GOVERN 6.1 - Policies and procedures address AI risks stemming from third-party resources

OWASP LLM Top 10

LLM03:2025 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2026-57516?

Ray's WebDataset reader blindly deserializes tar archive contents with pickle.loads() and torch.load(weights_only=False), so any tar file fed into read_webdataset() can execute arbitrary code on every Ray worker that processes it — a classic pickle/PyTorch RCE pattern (CWE-502) landing in a distributed compute framework rather than a single host. Ray underpins training and data-preprocessing pipelines at scale, so one malicious dataset shard pulled from a shared bucket, a public dataset mirror, or an untrusted collaborator can pivot into code execution across an entire worker fleet, not just one machine. There's no CISA KEV listing, no public exploit, and no EPSS score yet, so this hasn't been weaponized in the wild, but the trigger condition — pointing read_webdataset() at a crafted tar, no auth or elevated privileges needed — is a routine action in ML data-loading workflows. Upgrade to Ray 2.56.0 immediately, and until every worker is patched, treat WebDataset inputs as untrusted: restrict read_webdataset() to vetted internal sources and monitor Ray worker processes for unexpected pickle/torch.load activity or outbound connections.

Is CVE-2026-57516 actively exploited?

No confirmed active exploitation of CVE-2026-57516 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-57516?

Upgrade to Ray >= 2.56.0, which removes the unconditional pickle.loads()/torch.load(weights_only=False) calls in webdataset_datasource.py. Until patched, do not call read_webdataset() on tar archives from external, shared, or otherwise untrusted sources — restrict ingestion to vetted internal buckets with strict access control. Scan .pkl/.pickle members with a tool like picklescan before ingestion, and avoid torch.load() on .pt/.pth files without weights_only=True. Harden worker isolation (no cloud metadata endpoint access, restricted egress, minimal IAM scope) so a single-worker compromise doesn't cascade into cluster-wide or cloud-wide compromise. Monitor Ray worker processes for anomalous pickle/torch.load invocations, unexpected subprocess spawns, or outbound network connections correlated with dataset ingestion jobs.

What systems are affected by CVE-2026-57516?

This vulnerability affects the following AI/ML architecture patterns: training pipelines, data preprocessing pipelines, distributed compute clusters.

What is the CVSS score for CVE-2026-57516?

CVE-2026-57516 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.55%.

What is the AI security impact?

Affected AI Architectures

training pipelinesdata preprocessing pipelinesdistributed compute clusters

MITRE ATLAS Techniques

AML.T0010.002 Data

AML.T0011 User Execution

AML.T0011.000 Unsafe AI Artifacts

AML.T0018.002 Embed Malware

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: Annex A.7

NIST AI RMF: GOVERN 6.1

OWASP LLM Top 10: LLM03:2025

What are the technical details?

Original Advisory

Ray prior to 2.56.0 contains an unsafe deserialization vulnerability in the WebDataset reader that allows attackers to achieve remote code execution by supplying a malicious tar archive to the read_webdataset() function. The _default_decoder() function in webdataset_datasource.py unconditionally calls pickle.loads() on tar entries with .pkl/.pickle extensions and torch.load() with weights_only=False on .pt/.pth entries, executing arbitrary code inside Ray remote workers on every worker that processes the malicious archive.

Exploitation Scenario

An attacker uploads a poisoned WebDataset shard (e.g., a plausibly-named 'training_shard_0042.tar') to a public dataset repository or a bucket shared with the target organization. Inside the tar, one entry is a .pkl file with a malicious __reduce__ payload, or a .pth file crafted to execute code when loaded with torch.load(weights_only=False). When the victim's Ray Data/Train pipeline calls read_webdataset() to load the shard for a training or preprocessing job, _default_decoder() automatically deserializes every matching entry with no validation — executing the payload on every worker node assigned to process that shard, potentially dozens of nodes in a distributed job simultaneously. This gives the attacker a foothold across the cluster and access to any cloud credentials attached to the compromised workers.

Weaknesses (CWE)

CWE-502 Deserialization of Untrusted Data Primary CWE-502 Deserialization of Untrusted Data Primary CWE-94 Improper Control of Generation of Code ('Code Injection') Primary CWE-502 Deserialization of Untrusted Data

CWE-502 — Deserialization of Untrusted Data: The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

[Architecture and Design, Implementation] If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
[Implementation] When deserializing data, populate a new object rather than just deserializing. The result is that the data flows through safe input validation and that the functions are safe.

Source: MITRE CWE corpus.