CVE-2023-48023 Server-side request forgery in n/a
Anyscale Ray allows Server-Side Request Forgery via the log_proxy endpoint, potentially exposing internal network resources.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-48023?
CVE-2023-48023 is a critical server-side request forgery vulnerability in n/a, published on 28 Nov 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Anyscale Ray 2.6.3 and 2.8.0 allows /log_proxy SSRF. NOTE: the vendor's position is that this report is irrelevant because Ray, as stated in its documentation, is not intended for use outside of a strictly controlled network environment
Weakness: CWE-918
Which versions are affected by CVE-2023-48023?
It affects 1 product.
Products include Anyscale Ray.
How do I fix CVE-2023-48023?
No fix has been published for CVE-2023-48023 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2023-48023 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-48023 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in n/a
- CVE-2025-62593 Ray-Project Ray Code Injection
- CVE-2023-48022 Ray has arbitrary code execution via jobs submission API
- CVE-2026-41486 Ray: Remote Code Execution via Parquet Arrow Extension Type Deserialization
- CVE-2026-32981 Ray Dashboard <= 2.8.0 Path Traversal Leading to Local File Disclosure
- CVE-2026-57516 Ray < 2.56.0 Unsafe Deserialization RCE via WebDataset Reader
Sources
Also known as GHSA-3xqf-mvhg-35j8.