High severity · published May 8, 2026
CVE-2026-41486
Ray: Remote Code Execution via Parquet Arrow Extension Type Deserialization
8.8
CVSS
0.5%
EPSS
No
On KEV
Description
Ray is an AI compute engine. From version 2.54.0 to before version 2.55.0, Ray Data registers custom Arrow extension types (ray.data.arrow_tensor, ray.data.arrow_tensor_v2, ray.data.arrow_variable_shaped_tensor) globally in PyArrow. When PyArrow reads a Parquet file containing one of these extension types, it calls __arrow_ext_deserialize__ on the field's metadata bytes. Ray's implementation passes these bytes directly to cloudpickle.loads(), achieving arbitrary code execution during schema parsing, before any row data is read. This issue has been patched in version 2.55.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RA
ray · ray-project
>= 2.54.0, < 2.55.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-41486
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-41486
Patch
https://github.com/ray-project/ray/commit/c02bd31ae31996805868baa446a131a8d304525f
Issue Tracking
https://github.com/ray-project/ray/pull/62056
Product
https://github.com/ray-project/ray/releases/tag/ray-2.55.0
Vendor Advisory
https://github.com/ray-project/ray/security/advisories/GHSA-mw35-8rx3-xf9r
More from ray
8.8
CVE-2025-62593
Ray is vulnerable to RCE via Safari & Firefox Browsers through DNS Rebinding Attack
9.8
CVE-2023-6019
A command injection existed in Ray's cpu_profile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remotely without authentication
7.5
CVE-2026-32981
Ray Dashboard <= 2.8.0 Path Traversal Leading to Local File Disclosure
7.5
CVE-2023-6020
LFI in Ray's /static/ directory allows attackers to read any file on the server without authentication
7.5
CVE-2023-6021
LFI in Ray's log API endpoint allows attackers to read any file on the server without authentication