●PocketClawAI security alerts
Sign in
highCVSS 7.5NVD status: Modified

CVE-2026-32981

Ray: A path traversal vulnerability was identified in Ray Dashboard (default port 8265) in Ray versions prior to 2.8.1.

ComponentRay
Severityhigh (CVSS 7.5)
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Published (NVD)2026-03-17
Last modified2026-10-08
Affected versions
ray < 2.8.1
Fixed in2.8.1
WeaknessCWE-22
CISA KEVnot listed

NVD description

A path traversal vulnerability was identified in Ray Dashboard (default port 8265) in Ray versions prior to 2.8.1. Due to improper validation and sanitization of user-supplied paths in the static file handling mechanism, an attacker can use traversal sequences (e.g., ../) to access files outside the intended static directory, resulting in local file disclosure.

Does CVE-2026-32981 hit the version you run?Paste your docker-compose.yml, requirements.txt or package.json. The scanner checks your pinned versions against this CVE and every other one we track for Ray.
Check my stack

What to do

  • Upgrade Ray to 2.8.1 or later.
  • Do not expose the component's API or UI to the internet without authentication in front of it.

Sources