8.7
High
CVE-2026-32981 A path traversal vulnerability was identified in Ray Dashboard (default port 8265) in Ray versions prior to 2.8.1
Description
A path traversal vulnerability was identified in Ray Dashboard (default port 8265) in Ray versions prior to 2.8.1. Due to improper validation and sanitization of user-supplied paths in the static file handling mechanism, an attacker can use traversal sequences (e.g., ../) to access files outside the intended static directory, resulting in local file disclosure.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat AI Inference Server 3.2 1775252598 | earliest → < 1775252598 | 1775252598 |
| Red Hat OpenShift AI 2.25 1783998774 | earliest → < 1783998774 | 1783998774 |
| Red Hat OpenShift AI 3.3 1778677722 | earliest → < 1778677722 | 1778677722 |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Versions not published | |
| Red Hat OpenShift AI (RHOAI) | Versions not published | |
| ray 2.8 | earliest → < 2.8.1 | 2.8.1 |
References
- packetstorm.news packetstorm.news
- github.com github.com
- VulnCheck Advisory: Ray Dashboard <= 2.8.0 Path Traversal Leading to Local File Disclosure www.vulncheck.com
Timeline
- Published
- Last modified
Other CVEs of Red Hat AI Inference Server 3.2
The 63 CVEs of Red Hat AI Inference Server 3.2 →
CVE-2026-15588
Gdbusserver: glib2: gdbusserver pre-authentication dos via unbounded sasl line buffering
5.3
Medium
CVE-2026-16118
Xdgmime: heap-based buffer overflow in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c
7.1
High
CVE-2026-58015
Glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive
5.9
Medium
CVE-2026-58014
Glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list"
7.3
High