Anyscale vulnerabilities
We track 3 vulnerabilities in Anyscale products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on July 1, 2026.
Latest Anyscale vulnerabilities
- 8.8 High severity
Ray: Deserialization of Untrusted Data
Ray prior to 2.56.0 contains an unsafe deserialization vulnerability in the WebDataset reader that allows attackers to achieve remote code execution by supplying a malicious tar archive to the read_webdataset() function. The _default_decoder() function in webd
- 9.1 Critical severity
Ray: Server-Side Request Forgery
Anyscale Ray 2.6.3 and 2.8.0 allows /log_proxy SSRF. NOTE: the vendor's position is that this report is irrelevant because Ray, as stated in its documentation, is not intended for use outside of a strictly controlled network environment
- 9.8 Critical severity
ray: Server-Side Request Forgery
Anyscale Ray 2.6.3 and 2.8.0 allows a remote attacker to execute arbitrary code via the job submission API. NOTE: the vendor's position is that this report is irrelevant because Ray, as stated in its documentation, is not intended for use outside of a strictly