CVE-2026-32981

The primary impact of this vulnerability is unauthorized access to files on the Ray Dashboard server. An attacker could leverage path traversal sequences (e.g., ../../) within requests to the dashboard to navigate outside the designated static file directory. This could expose configuration files, source code, or other sensitive data stored on the system. While the vulnerability is limited to local file disclosure, the potential for data compromise is significant, particularly if the server hosts critical Ray cluster configurations or secrets. The blast radius extends to any system running a vulnerable Ray Dashboard instance.

Organizations deploying Ray clusters with the Ray Dashboard enabled are at risk, particularly those running versions 0.0 through 2.8.1. Shared hosting environments where multiple users share the same Ray Dashboard instance are especially vulnerable, as an attacker could potentially access files belonging to other users.

• python / server:

import os
import requests

url = 'http://your_ray_dashboard_ip:8265/static/../../../../etc/passwd'
response = requests.get(url)

if response.status_code == 200:
    print('Potential Path Traversal Detected: ', response.text[:100]) # Print first 100 chars
else:
    print('No Path Traversal Detected')

• linux / server:

find / -name 'ray_dashboard.conf' -print 2>/dev/null | while read file;
do
  grep -q 'path_traversal_bypass' $file && echo "Potential Path Traversal Configuration Found: $file";
done

1. 2026-03-17Disclosure

   disclosure

1. Reserviert2026-03-17
2. Veröffentlicht2026-03-17
3. EPSS aktualisiert2026-03-25

The recommended mitigation is to immediately upgrade Ray to version 2.8.1 or later, which includes the necessary fix for this path traversal vulnerability. If an immediate upgrade is not feasible, consider implementing a Web Application Firewall (WAF) rule to filter requests containing potentially malicious path traversal sequences (e.g., '../', './..'). Additionally, restrict access to the Ray Dashboard (default port 8265) to trusted networks and users. Regularly review and audit file permissions within the static file directory to ensure that only authorized files are accessible. After upgrade, confirm by attempting to access files outside the static directory via the dashboard and verifying that access is denied.