CVE-2026-95897: Dask Deserialization RCE Vulnerability

CVE-2026-95897 Overview

CVE-2026-95897 is a deserialization vulnerability in the Dask parallel computing library affecting versions up to 2026.8.0. The flaw resides in the from_npy_stack function within dask/array/core.py, part of the Loader component. An attacker can supply crafted input that triggers unsafe deserialization during array loading. The issue has been categorized under [CWE-20] (Improper Input Validation) and can be triggered over a network with limited privileges and user interaction.

Critical Impact
Successful exploitation may lead to deserialization of attacker-controlled data with limited confidentiality, integrity, and availability impact. The exploit technique has been publicly disclosed.

Affected Products

Dask versions up to and including 2026.8.0
Component: Loader (dask/array/core.py)
Function: from_npy_stack

Discovery Timeline

2026-09-23 - CVE CVE-2026-95897 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-95897

Vulnerability Analysis

Dask is a Python library for parallel and distributed computing that provides scalable analytics on arrays, dataframes, and task graphs. The from_npy_stack function loads a stack of NumPy .npy files from a directory into a Dask array. During this process, the loader deserializes metadata and array descriptors from the source location. When the input is attacker-controlled, the deserialization step processes untrusted data without sufficient validation.

The project maintainers were notified through a public issue report but had not responded at the time of disclosure. This means downstream consumers must apply compensating controls until an upstream fix is available.

Root Cause

The root cause is improper input validation [CWE-20] in the from_npy_stack loader path. The function trusts metadata contained within the loaded stack and passes it through Python deserialization primitives. No integrity check or schema validation is enforced before objects are reconstructed in memory.

Attack Vector

An attacker delivers a malicious .npy stack directory to a target system running Dask. When a user or automated pipeline calls from_npy_stack against that path, the crafted payload is deserialized. The attack requires user interaction, such as invoking the loader against attacker-supplied storage, and low privileges on the target. Because Dask is commonly used in shared data science environments and pipelines that ingest external datasets, path exposure is a realistic delivery vector.

// No verified proof-of-concept code is published.
// See the GitHub issue for technical discussion:
// https://github.com/dask/dask/issues/12578

Detection Methods for CVE-2026-95897

Indicators of Compromise

Unexpected .npy or metadata files appearing in directories consumed by Dask pipelines
Python processes spawning child processes or making outbound network connections shortly after calls to from_npy_stack
Unusual file reads under directories referenced by Dask loader jobs originating from untrusted sources

Detection Strategies

Inventory Python environments for installed Dask versions and flag any version at or below 2026.8.0
Instrument data ingestion code paths that call from_npy_stack and log the source paths being loaded
Alert on Dask worker processes performing operations outside expected compute behavior, such as shell invocations or credential file access

Monitoring Recommendations

Monitor package inventories in data science and ML workloads for vulnerable Dask releases
Track filesystem access patterns of Dask worker processes for reads from untrusted or user-writable locations
Correlate loader invocations with subsequent process, network, or file activity to identify post-deserialization behavior

How to Mitigate CVE-2026-95897

Immediate Actions Required

Restrict from_npy_stack usage to directories controlled by trusted producers only
Validate and sandbox any Dask pipelines that ingest datasets from external or multi-tenant sources
Review data science workflows for exposure of the loader function to untrusted input paths

Patch Information

At the time of publication, no upstream patch has been released. The maintainers were informed through a public issue report but had not responded. Track the GitHub Issue #12578 and the Dask repository for fix availability. Reference details are also tracked in VulDB CVE-2026-95897.

Workarounds

Avoid calling from_npy_stack on paths sourced from untrusted users or external systems
Run Dask workers under least-privilege service accounts with restricted filesystem and network egress
Execute Dask jobs that must ingest external data in isolated containers or ephemeral sandboxes
Apply integrity checks such as cryptographic hashes to .npy stacks before loading

bash

# Identify installed Dask version across Python environments
python -c "import dask; print(dask.__version__)"

# Example: restrict loader to a known-trusted directory
export DASK_TRUSTED_INPUT_DIR=/opt/data/trusted
find "$DASK_TRUSTED_INPUT_DIR" -type d -perm -o+w -print