CVE-2026-32981: Anyscale Ray path traversal in Ray Dashboard

CVE-2026-32981 · Severity: high · CVSS 7.5 · Published 2026-03-17

A security vulnerability has been identified in the Ray Dashboard, a tool used to monitor and manage distributed AI and machine learning workloads. An attacker can exploit this flaw to bypass security restrictions and read sensitive files directly from the server's local storage. This could lead to the exposure of configuration files, credentials, or other private data, potentially compromising the entire AI infrastructure.

Technologies: ray (PyPI), Red Hat AI Inference Server. Vendors: PyPI, Red Hat.

Quick answers

Is CVE-2026-32981 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-32981 being exploited in the wild.
How severe is CVE-2026-32981?
High severity, with a CVSS score of 7.5, published 17 March 2026.
Which products and versions are affected?
ray (PyPI) < 2.8.1, ECOSYSTEM:introduced=0,fixed=2.8.1.
Is there a fix for CVE-2026-32981?
Yes. ray (PyPI): upgrade to 2.8.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-32981 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-32981?
Check whether you run ray (PyPI) or Red Hat AI Inference Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • ray (PyPI): upgrade to 2.8.1 or later
    pip install "ray>=2.8.1"

Technical details

A path traversal vulnerability exists in the Ray Dashboard's static file handling mechanism due to improper validation and sanitization of user-supplied input. By sending specially crafted requests containing traversal sequences (e.g., '../'), an unauthenticated remote attacker can access arbitrary files on the host system that are readable by the Ray process. The vulnerability is located in the component serving static assets, typically listening on port 8265. This issue was addressed in Ray version 2.8.1 by implementing stricter path validation. Red Hat has also issued advisories for affected products that bundle Ray, such as OpenShift AI.

Affected products

  • Anyscale Ray < 2.8.1
  • Red Hat Red Hat OpenShift AI 2.25, 3.3
  • Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3
  • Red Hat Red Hat AI Inference Server 3.2

Identifiers

  • CVE-2026-32981
  • GHSA-j3mh-qmjj-xp83
  • PYSEC-2026-130

Timeline

  • 2026-03-17: disclosed
  • 2026-03-17: advisory
  • 2026-05-20: patched: Red Hat released patches for OpenShift AI via RHSA-2026:19712

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.