Free AI Safety Workshop — in collaboration with explainx.aiSave your seat
AgentbeamBeta
AI agent vulnerability · Ray

CVE-2026-32981: Ray Dashboard is vulnerable to path traversal through its static file handling mechanism

highCVSS 4.0 8.7 · 3.1 7.5GHSA-j3mh-qmjj-xp83

A path traversal vulnerability was identified in Ray Dashboard (default port 8265) in Ray versions prior to 2.8.1. Due to improper validation and sanitization of user-supplied paths in the static file handling mechanism, an attacker can use traversal sequences (e.g., ../) to access files outside the intended static directory, resulting in local file disclosure.

Published Mar 17, 2026 · Updated Jun 9, 2026

Affected packages

ray

Ecosystem
PyPI
Affected
< 2.8.1
Fixed in
2.8.1
Check
pip show ray

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

A path traversal vulnerability was identified in Ray Dashboard (default port 8265) in Ray versions prior to 2.8.1. Due to improper validation and sanitization of user-supplied paths in the static file handling mechanism, an attacker can use traversal sequences (e.g., ../) to access files outside the intended static directory, resulting in local file disclosure.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Ray vulnerabilities

All Ray entries