p PatchFirst

CVE-2026-27482

CVE-2026-27482 · Ray: Dashboard DELETE endpoints allow unauthenticated browser-triggered DoS (Serve shutdown / job deletion)

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Ray is an AI compute engine. In versions 2.53.0 and below, thedashboard HTTP server blocks browser-origin POST/PUT but does not cover DELETE, and key DELETE endpoints are unauthenticated by default. If the dashboard/agent is reachable (e.g., --dashboard-host=0.0.0.0), a web page via DNS rebinding or same-network access can issue DELETE requests that shut down Serve or delete jobs without user interaction. This is a drive-by availability impact. The fix for this vulnerability is to update to Ray 2.54.0 or higher.

CVSS 5.9 · Medium · EPSS 0.3% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • ray

    Versions
    • < 2.54.0: Affected

    No fix published

  • ray PyPI

    Versions
    • 0.1.1
    • 0.1.2
    • 0.2.0
    • 0.2.1
    • 0.2.2
    • 0.3.0
    • 0.3.1
    • 0.4.0
    • 0.5.0
    • 0.5.2
    • 0.5.3
    • 0.6.0
    • 0.6.1
    • 0.6.2
    • 0.6.3
    • 0.6.4
    • 0.6.5
    • 0.6.6
    • 0.7.0
    • 0.7.1
    • 0.7.2
    • 0.7.3
    • 0.7.4
    • 0.7.5
    • 0.7.6
    • 0.7.7
    • 0.8.0
    • 0.8.1
    • 0.8.2
    • 0.8.3
    • 0.8.4
    • 0.8.5
    • 0.8.6
    • 0.8.7
    • 1.0.0
    • 1.0.1
    • 1.1.0
    • 1.10.0
    • 1.11.0
    • 1.11.1
    • 1.12.0
    • 1.12.1
    • 1.13.0
    • 1.2.0
    • 1.3.0
    • 1.4.0
    • 1.4.1
    • 1.5.0
    • 1.5.1
    • 1.5.2
    • 1.6.0
    • 1.7.0
    • 1.7.1
    • 1.8.0
    • 1.9.0
    • 1.9.1
    • 1.9.2
    • 2.0.0
    • 2.0.1
    • 2.1.0
    • 2.10.0
    • 2.11.0
    • 2.12.0
    • 2.2.0
    • 2.20.0
    • 2.21.0
    • 2.22.0
    • 2.23.0
    • 2.24.0
    • 2.3.0
    • 2.3.0rc0
    • 2.3.1
    • 2.30.0
    • 2.31.0
    • 2.32.0
    • 2.32.0rc0
    • 2.33.0
    • 2.34.0
    • 2.35.0
    • 2.36.0
    • 2.36.1
    • 2.37.0
    • 2.38.0
    • 2.39.0
    • 2.4.0
    • 2.40.0
    • 2.41.0
    • 2.42.0
    • 2.42.1
    • 2.43.0
    • 2.44.0
    • 2.44.1
    • 2.45.0
    • 2.46.0
    • 2.47.0
    • 2.47.1
    • 2.48.0
    • 2.49.0
    • 2.49.1
    • 2.49.2
    • 2.5.0
    • 2.5.1
    • 2.50.0
    • 2.50.1
    • 2.51.0
    • 2.51.1
    • 2.51.2
    • 2.52.0
    • 2.52.1
    • 2.53.0
    • 2.6.0
    • 2.6.1
    • 2.6.2
    • 2.6.3
    • 2.7.0
    • 2.7.0rc0
    • 2.7.1
    • 2.7.2
    • 2.8.0
    • 2.8.1
    • 2.9.0
    • 2.9.1
    • 2.9.2
    • 2.9.3
    Affected ranges
    • ECOSYSTEM: < 2.54.0

    Update to 2.54.0

Original sources

Check your server →