Arbitrary Code Execution Vulnerability in Ray AI Compute Engine

CVE-2026-41486

What is CVE-2026-41486?

The Ray AI Compute Engine has a vulnerability where, prior to version 2.55.0, it registers custom Arrow extension types in PyArrow. This misconfiguration allows arbitrary code execution when PyArrow processes Parquet files containing these extension types. By exploiting this flaw, malicious actors could execute arbitrary code on the server during schema parsing of such files, posing a significant risk to the integrity of the system. The issue has been effectively addressed in version 2.55.0.

References