Ray prior to 2.56.0 contains an unsafe deserialization vulnerability in the WebDataset reader that allows attackers to achieve remote code execution by supplying a malicious tar archive to the read_webdataset() function. The _default_decoder() function in webdataset_datasource.py unconditionally calls pickle.loads() on tar entries with .pkl/.pickle extensions and torch.load() with weights_only=False on .pt/.pth entries, executing arbitrary code inside Ray remote workers on every worker that processes the malicious archive.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Ray prior to 2.56.0 contains an unsafe deserialization vulnerability in the WebDataset reader that allows
    attackers to achieve remote code execution by supplying a malicious tar archive to the read_webdataset()
    function. The _default_decoder() function in webdataset_datasource.py unconditionally calls pickle.loads()
    on tar entries with .pkl/.pickle extensions and torch.load() with weights_only=False on .pt/.pth entries,
    executing arbitrary code inside Ray remote workers on every worker that processes the malicious archive.
    (CVE-2026-57516)

According to its self-reported version number, Ray is prior to 2.56.0. Therefore, it may be affected by a Remote Code Execution due to the unsafe deserialization performed by the default decoder of ray.data.read_webdataset(), which calls pickle.loads() on .pickle / .pkl members and torch.load() with weights_only=False on .pt / .pth members of an attacker-supplied WebDataset TAR file.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
463579	Echo: ray: security update to 2.56.0	Tenable Cloud Security	Echo Local Security Checks	Local	high
463579	Echo: ray: security update to 2.56.0	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
115438	Ray < 2.56.0 Remote Code Execution	Web App Scanning	Artificial Intelligence	Version Based	high
445291	SCA: security update for ray (GHSA-hhrp-gw25-jr43)	Tenable Cloud Security	SCA Checks	Local	high
445291	SCA: security update for ray (GHSA-hhrp-gw25-jr43)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-57516

high

Tenable Plugins

high

high

high

high

high