CVE-2026-27482 Details
Description
Ray is an AI compute engine. In versions 2.53.0 and below, thedashboard HTTP server blocks browser-origin POST/PUT but does not cover DELETE, and key DELETE endpoints are unauthenticated by default. If the dashboard/agent is reachable (e.g., --dashboard-host=0.0.0.0), a web page via DNS rebinding or same-network access can issue DELETE requests that shut down Serve or delete jobs without user interaction. This is a drive-by availability impact. The fix for this vulnerability is to update to Ray 2.54.0 or higher.
A vulnerability in Ray's dashboard HTTP server allows unauthenticated DELETE requests from browsers, which can be exploited to shut down Ray Serve applications or delete jobs. This issue is present in Ray versions prior to 2.54.0. The vulnerability arises because the server blocks POST and PUT requests from browsers but does not apply the same restriction to DELETE requests. Key DELETE endpoints can be accessed without authentication, creating a denial-of-service impact by disrupting active applications and job management.
Users can update to Ray version 2.54.0 or higher to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Feb 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ray-project/ray/commit/0fda8b824cdc9dc6edd763bb28dfd7d1cc9b02a4 | [email protected] | Patch |
| https://github.com/ray-project/ray/pull/60526 | [email protected] | Issue TrackingPatch |
| https://github.com/ray-project/ray/releases/tag/ray-2.54.0 | [email protected] | ProductRelease Notes |
| https://github.com/ray-project/ray/security/advisories/GHSA-q5fh-2hc8-f6rq | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-396 | Declaration of Catch for Generic Exception | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| anyscale ray | < 2.54.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 4, 2026 | Reanalysis | [email protected] |
| Feb 24, 2026 | Initial Analysis | [email protected] |
| Feb 21, 2026 | New CVE Received | [email protected] |