PT-2026-21334 · Anyscale · Ray

Qi-Scape · Published 2026-02-20 · Updated 2026-03-10 · CVE-2026-27482

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions Ray versions 2.53.0 and below

Description Ray’s dashboard HTTP server does not adequately protect DELETE requests, and key DELETE endpoints are unauthenticated by default. If the dashboard/agent is reachable, a web page using DNS rebinding or same-network access can issue DELETE requests that shut down Serve or delete jobs without user interaction, resulting in a denial-of-service condition. The vulnerable endpoints include:

• /api/serve/applications/ which calls serve.shutdown().
• /api/jobs/{job or submission id}.
• /api/job agent/jobs/{job or submission id}. The issue arises because the get browsers no post put middleware function only checks POST and PUT requests, neglecting DELETE requests. Browser requests include headers like User-Agent and Origin, but the middleware does not prevent unauthorized DELETE requests. Dashboard token authentication is optional and disabled by default, increasing the risk when binding to 0.0.0.0 for remote access.

Recommendations Update to Ray version 2.54.0 or higher.

Exploit

Fix

DoS

Missing Authentication

Weakness Enumeration

CWE-306

CWE-396

Related Identifiers

CVE-2026-27482

ECHO-0E02-C16F-6496

GHSA-Q5FH-2HC8-F6RQ

Affected Products

Ray

References · 18

• 🔥 https://github.com/ray-project/ray/security/advisories/GHSA-q5fh-2hc8-f6rq · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27482.json · Exploit
• https://github.com/ray-project/ray/commit/0fda8b824cdc9dc6edd763bb28dfd7d1cc9b02a4 · Patch
• https://github.com/ray-project/ray/pull/60526 · Patch
• https://osv.dev/vulnerability/CVE-2026-27482 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q5fh-2hc8-f6rq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27482 · Security Note
• https://github.com/ray-project/ray · Note
• https://github.com/ray-project/ray/releases/tag/ray-2.54.0 · Note
• https://t.me/cveNotify/152715 · Telegram Post
• https://twitter.com/_cvereports/status/2025143624325808438 · Twitter Post
• https://twitter.com/CVEnew/status/2025154166776057954 · Twitter Post
• https://twitter.com/CyberAmyntas/status/2031502113071911221 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1raarn5/resumen_diario_de_vulnerabilidades_20022026 · Reddit Post
• https://t.me/CVEtracker/45371 · Telegram Post