CVE-2026-32981: Path Traversal Vulnerability in Ray Package Allows Local File Disclosure
Summary
CVE-2026-32981: A path traversal vulnerability was identified in Ray Dashboard (default port 8265) in Ray versions prior to 2.8.1. Affects ray versions < 2.8.1. Fixed in 2.8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Ray is an open-source framework designed for building and running distributed applications. It provides a simple interface for parallel and distributed computing, enabling developers to scale their applications seamlessly. The Ray Dashboard, which operates on the default port 8265, serves as a monitoring and management interface for Ray applications. However, prior to version 2.8.1, the Ray Dashboard was susceptible to a path traversal vulnerability that could compromise the security of the system.
Vulnerability Detail
A path traversal vulnerability was identified in the Ray Dashboard in versions prior to 2.8.1. This issue arises from improper validation and sanitization of user-supplied paths within the static file handling mechanism. An attacker can exploit this vulnerability by using traversal sequences (e.g., ../) to access files outside the intended static directory, leading to local file disclosure. This could potentially expose sensitive information stored on the server, posing a significant security risk.
How To Fix
Latest published version: 2.59.0 as of 23 Oct 2026
pip install --upgrade "ray==2.59.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.8.1
This is the first release that contains the fix.
pip install --upgrade "ray==2.8.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the Ray Dashboard by implementing network-level controls, such as firewall rules, to limit access to trusted IP addresses only. This will help mitigate the risk of exploitation until the package can be updated.
Conclusion
The path traversal vulnerability identified in the Ray Dashboard poses a significant risk to users of versions prior to 2.8.1. It is crucial to update to the patched version to safeguard against potential file disclosure attacks. Implementing network-level controls can serve as a temporary measure until the update is completed.
See every vulnerability recorded for ray →
FAQ
A path traversal vulnerability allows an attacker to access files and directories that are stored outside the intended directory, potentially leading to unauthorized data exposure.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Failing to address this vulnerability may lead to unauthorized access to sensitive files, which could result in data breaches and compromise the security of your application.
Yes, you should upgrade to Ray version 2.8.1 or later to ensure that the path traversal vulnerability is fixed.
The CVSS score for this vulnerability is 7.5, indicating a high level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for ray.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
