8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-32981

CVE-2026-32981: Ray Dashboard <= 2.8.0 Path Traversal Leading to Local File Disclosure

A path traversal vulnerability was identified in Ray Dashboard (default port 8265) in Ray versions prior to 2.8.1. Due to improper validation and sanitization of user-supplied paths in the static file handling mechanism, an attacker can use traversal sequences (e.g., ../) to access files outside the intended static directory, resulting in local file disclosure.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-32981

CVE-2026-32981:

8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
ray	pip	< 2.8.1	2.8.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the security patches between the last vulnerable version and the first patched version (2.8.1) identified two main vulnerable functions. The vulnerability, as described, is a path traversal in the Ray Dashboard's static file handling. The investigation of the commits revealed that the issue stemmed from improper handling of user-supplied paths in the log viewing feature.

gRPC Endpoint Vulnerability: The ray.dashboard.modules.log.log_agent.LogAgentV1Grpc.StreamLog function, a gRPC service, was found to be vulnerable. The original code directly concatenated a user-provided filename to the base log directory, failing to prevent path traversal attacks. Commit 74596397aa4f2447d6c1209ecc8709597b320d90 addressed this by adding a secure path resolution function (_resolve_filename) that strictly enforces that files can only be accessed from within the intended log directory.
HTTP Proxy Vulnerability: The ray.dashboard.modules.log.log_head.LogHead.get_log_from_proxy function exposed the vulnerability over HTTP. This function was an open proxy that would fetch any URL provided by the user. An attacker could use this to request local files via a file:// URL with traversal paths. Commit 82a8df138fe7fcc5c42536ebf26e8c3665704fee completely removed this insecure API and migrated the dashboard's frontend to use a new, secure state-based API for log access.

The root cause was a failure to sanitize and validate user-controlled input that was used to construct file paths for reading. The combination of the insecure gRPC method and the open proxy HTTP endpoint allowed for the disclosure of local files.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.