PT-2025-48224 · Anyscale · Anyscale Ray

Jonathan Leitschuh · Published 2025-11-27 · Updated 2025-11-29 · CVE-2025-34351

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Anyscale Ray version 2.52.0

Description Anyscale Ray 2.52.0 has a default configuration where token-based authentication for Ray management interfaces, including the dashboard and Jobs API, is disabled unless explicitly enabled by setting the RAY AUTH MODE variable to 'token'. Without authentication enabled, a remote attacker with network access to these interfaces can submit jobs and execute arbitrary code on the Ray cluster. The API endpoint for job submission is vulnerable.

Recommendations Enable token authentication by setting the RAY AUTH MODE variable to 'token' to protect the cluster from unauthorized access.

Fix

RCE

Weakness Enumeration

CWE-1188

CWE-304

Related Identifiers

CVE-2025-34351

ECHO-B39D-0C13-31FE

GHSA-GX77-XGC2-4888

Affected Products

Anyscale Ray

References · 15

• https://osv.dev/vulnerability/GHSA-gx77-xgc2-4888 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-34351 · Security Note
• https://cve.org/resourcessupport/allresources/cnarules#section_4-1_Vulnerability_Determination · Security Note
• https://github.com/ray-project/ray · Note
• https://github.com/ray-project/ray/releases/tag/ray-2.52.0 · Note
• https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-w8vc-465m-jjw6 · Note
• https://oligo.security/blog/shadowray-attack-ai-workloads-actively-exploited-in-the-wild · Note
• https://twitter.com/VulmonFeeds/status/1993885783594324370 · Twitter Post
• https://docs.ray.io/en/latest/ray-security/token-auth.html · Note
• https://twitter.com/0dayPublishing/status/1993876215531184509 · Twitter Post
• https://linkedin.com/posts/jonathan-leitschuh_the-latest-piece-of-mind-bending-research-activity-7396976425997606912-qizE · Note
• https://vulncheck.com/advisories/anyscale-ray-token-authentication-disabled-by-default-insecure-configuration · Note
• https://oligo.security/blog/shadowray-2-0-attackers-turn-ai-against-itself-in-global-campaign-that-hijacks-ai-into-self-propagating-botnet · Note
• https://twitter.com/SecAideInfo/status/1994711629129552099 · Twitter Post
• https://t.me/CVEtracker/38358 · Telegram Post