8.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-41486

CVE-2026-41486: Ray: Remote Code Execution via Parquet Arrow Extension Type Deserialization

Ray is an AI compute engine. From version 2.54.0 to before version 2.55.0, Ray Data registers custom Arrow extension types (ray.data.arrow_tensor, ray.data.arrow_tensor_v2, ray.data.arrow_variable_shaped_tensor) globally in PyArrow. When PyArrow reads a Parquet file containing one of these extension types, it calls arrow_ext_deserialize on the field's metadata bytes. Ray's implementation passes these bytes directly to cloudpickle.loads(), achieving arbitrary code execution during schema parsing, before any row data is read. This issue has been patched in version 2.55.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-41486

CVE-2026-41486:

8.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
ray	pip	>= 2.49.0, < 2.55.0	2.55.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the deserialization of custom Arrow extension types within Ray's data processing library. The root cause is the introduction of the _deserialize_with_fallback function in python/ray/air/util/tensor_extensions/arrow.py as part of PR #54831. This function attempts to deserialize data using cloudpickle.loads() before falling back to the safer json.loads().

When a Ray Data process reads a Parquet file, PyArrow identifies the custom Ray tensor extension types (ray.data.arrow_tensor, ray.data.arrow_tensor_v2, etc.) in the file's schema. For these types, PyArrow invokes their respective __arrow_ext_deserialize__ methods to process the extension metadata.

The patch analysis of commit 6654b6f5d6547d259995445d1611b199596a430b shows that the __arrow_ext_deserialize__ methods for ArrowTensorTypeV1, ArrowTensorTypeV2, and ArrowVariableShapedTensorType were modified to use the new _deserialize_with_fallback function. This function takes serialized metadata directly from the Parquet file and passes it to cloudpickle.loads(). Since cloudpickle can execute arbitrary code when deserializing a crafted payload, an attacker can create a malicious Parquet file that, when read by a Ray Data application, triggers remote code execution. The execution happens as soon as the file's schema is parsed, before any data rows are even accessed.

Vulnerable functions

_deserialize_with_fallback

python/ray/air/util/tensor_extensions/arrow.py

This function is the core of the vulnerability. It directly calls `cloudpickle.loads()` on the `serialized` input, which is derived from untrusted Parquet file metadata. This allows for arbitrary code execution.

ArrowTensorTypeV1.__arrow_ext_deserialize__

python/ray/air/util/tensor_extensions/arrow.py

This class method is an entry point for deserializing the `ArrowTensorTypeV1` extension type. It calls the vulnerable `_deserialize_with_fallback` function, passing untrusted data from the Parquet file's metadata.

ArrowTensorTypeV2.__arrow_ext_deserialize__

python/ray/air/util/tensor_extensions/arrow.py

This class method is an entry point for deserializing the `ArrowTensorTypeV2` extension type. It calls the vulnerable `_deserialize_with_fallback` function, passing untrusted data from the Parquet file's metadata.

ArrowVariableShapedTensorType.__arrow_ext_deserialize__

python/ray/air/util/tensor_extensions/arrow.py

This class method is an entry point for deserializing the `ArrowVariableShapedTensorType` extension type. It calls the vulnerable `_deserialize_with_fallback` function, passing untrusted data from the Parquet file's metadata.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.