CVE-2026-41486: 
Python vulnerability analysis and mitigation

CVE-2026-41486 is a Remote Code Execution (RCE) vulnerability in Anyscale Ray Data caused by unsafe deserialization of Arrow extension type metadata when reading Parquet files. Ray Data registers custom PyArrow extension types (ray.data.arrow_tensor, ray.data.arrow_tensor_v2, ray.data.arrow_variable_shaped_tensor) globally; when PyArrow reads a Parquet file containing one of these types, it invokes __arrow_ext_deserialize__ on the field's metadata bytes, which Ray passes directly to cloudpickle.loads(), enabling arbitrary code execution during schema parsing. Affected versions are Ray 2.49.0 through 2.54.0; the vulnerability was patched in Ray 2.55.0. It was first published on April 21, 2026, and carries a CVSS v3.1 score of 8.8 (High) and a CVSS v4.0 score of 8.9 (High) (GitHub Advisory, Ray Security Advisory).

The root cause is unsafe deserialization of untrusted data (CWE-502) combined with improper code injection (CWE-94). The vulnerable _deserialize_with_fallback function in python/ray/data/_internal/tensor_extensions/arrow.py attempted cloudpickle.loads() first on any metadata bytes received from a Parquet field, with no validation or integrity check. Because Ray registers its extension types globally in PyArrow, any Parquet read operation in the process — including ray.data.read_parquet(), pyarrow.parquet.read_table(), and pandas.read_parquet() — is affected. The vulnerability was originally introduced in commit f6d21db1a4 (PR #54831, July 2025) and first shipped in Ray 2.49.0, reintroducing a class of deserialization flaw that had been fixed in May 2024 (issue #41314, PR #45084). Exploitation occurs during schema parsing, before any row data is read, meaning the payload executes immediately upon opening a crafted file (GitHub Advisory, Fix PR #62056).

Successful exploitation results in arbitrary Python code execution as the Ray worker process user, leading to full server compromise. All three CIA pillars are critically impacted: an attacker can exfiltrate sensitive data (confidentiality), modify or corrupt data and models in the pipeline (integrity), and disrupt or terminate Ray worker processes (availability). Because Ray is commonly deployed in distributed AI/ML compute environments, a compromised worker could serve as a pivot point for lateral movement across the cluster, potentially affecting subsequent systems with equally high confidentiality, integrity, and availability impact as reflected in the CVSS v4.0 subsequent system metrics (GitHub Advisory, Ray Security Advisory).

No public proof-of-concept exploit code has been observed, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.045% (14th percentile), indicating a low current probability of exploitation in the next 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction — a Ray Data pipeline must be directed to read a crafted Parquet file — but requires no authentication or cluster access from the attacker, lowering the barrier for targeted attacks against Ray Data users (GitHub Advisory).

1. Craft a malicious Parquet file: Create a Parquet file with a column schema declaring one of Ray's registered extension types (e.g., ray.data.arrow_tensor, ray.data.arrow_tensor_v2, or ray.data.arrow_variable_shaped_tensor) as the field's Arrow extension type name.
2. Embed a malicious cloudpickle payload: Serialize an arbitrary Python payload (e.g., a reverse shell or command execution) using cloudpickle.dumps() and embed the resulting bytes as the extension type's metadata in the Parquet file's schema.
3. Deliver the file to the target: Place the crafted Parquet file in a location accessible to the Ray Data pipeline — such as a shared storage bucket, a data ingestion directory, or via a supply-chain/data poisoning attack — and convince or wait for a user or automated pipeline to read it.
4. Trigger schema parsing: When the victim's Ray Data process calls any Parquet read function (e.g., ray.data.read_parquet(), pandas.read_parquet(), or pyarrow.parquet.read_table()), PyArrow invokes __arrow_ext_deserialize__ on the metadata bytes during schema parsing.
5. Achieve code execution: Ray's _deserialize_with_fallback passes the metadata bytes to cloudpickle.loads(), deserializing and executing the attacker's payload as the Ray worker process user before any row data is read (GitHub Advisory, Fix PR #62056).

• Process: Unexpected child processes spawned by the Ray worker Python process (e.g., /bin/bash, curl, wget, python, nc) during Parquet file reads, particularly before any data processing output is produced.
• Network: Unusual outbound connections from Ray worker nodes to unknown external IP addresses or domains, especially immediately following a Parquet read operation; reverse shell connections originating from the Ray worker process.
• File System: Unexpected files written to the Ray worker's working directory or temp directories during Parquet ingestion; new scripts, binaries, or cron jobs created by the Ray worker process user.
• Logs: Ray worker logs showing errors or unexpected output during schema parsing of Parquet files; Python tracebacks referencing cloudpickle.loads() or __arrow_ext_deserialize__ in tensor_extensions/arrow.py; anomalous Parquet files with extension type metadata that is not valid JSON (binary/non-printable bytes in schema metadata fields).
• Application: Parquet files in data pipelines containing columns with extension type names matching ray.data.arrow_tensor, ray.data.arrow_tensor_v2, or ray.data.arrow_variable_shaped_tensor and non-JSON (binary cloudpickle) metadata bytes (GitHub Advisory, Fix PR #62056).

Primary remediation: Upgrade Ray to version 2.55.0 or later, which replaces cloudpickle.loads() with json.loads() as the default deserialization path for Arrow extension type metadata (Ray 2.55.0 Release, Fix PR #62056).

Workarounds for users unable to upgrade immediately:

• Restrict Ray Data pipelines to read Parquet files only from trusted, controlled sources; implement file validation and integrity checks before ingestion.
• Audit and monitor which Parquet files are being processed by Ray Data applications.
• If reading legacy files written by Ray 2.49–2.54 is required after upgrading, the opt-in environment variable RAY_DATA_AUTOLOAD_CLOUDPICKLE_TENSOR_METADATA=1 re-enables cloudpickle deserialization — use this only with files from fully trusted sources.
• Do not set RAY_DATA_AUTOLOAD_CLOUDPICKLE_TENSOR_METADATA=1 in environments where Parquet files from untrusted sources may be processed.

The vulnerability was reported by security researcher shakevsky and published by x01-emre via GitHub's security advisory process on April 21, 2026 (Ray Security Advisory). The fix was developed by Anyscale engineers and merged on March 27, 2026 (prior to public disclosure), with the patch shipped in Ray 2.55.0. The advisory notes this is a regression — a nearly identical vulnerability class was fixed in May 2024 and reintroduced in July 2025 via PR #54831, which has drawn attention to the importance of security review for deserialization code paths in AI/ML frameworks. Tenable's Nessus scanner (plugin 311475) added detection for this vulnerability shortly after disclosure.