CVE-2026-32981

Fixed upstream EPSS <1%CVSS 7.5

A path traversal vulnerability was identified in Ray Dashboard (default port 8265) in Ray versions prior to 2.8.1. Due to improper validation and sanitization of user-supplied paths in the static file handling mechanism, an attacker can use traversal sequences (e.g., ../) to access files outside the intended static directory, resulting in local file disclosure.

Published 2026-03-17 · CVE record · OSV

Products: ray-project ray, Red Hat AI Inference Server 3.2, Red Hat OpenShift AI 2.25, Red Hat OpenShift AI 3.3, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI)

Fixed upstream