CVE-2026-27482 Ray: Dashboard DELETE endpoints allow unauthenticated browser-triggered DoS (Serve shutdown / job deletion)
Unauthenticated DELETE requests in Ray dashboard allow attackers to shut down Serve or delete jobs via drive-by attacks if the dashboard is exposed.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-27482?
CVE-2026-27482 is a medium-severity missing authorization vulnerability in ray-project ray, published on 21 Feb 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Ray is an AI compute engine. In versions 2.53.0 and below, thedashboard HTTP server blocks browser-origin POST/PUT but does not cover DELETE, and key DELETE endpoints are unauthenticated by default. If the dashboard/agent is reachable (e.g., --dashboard-host=0.0.0.0), a web page via DNS rebinding or same-network access can issue DELETE requests that shut down Serve or delete jobs without user interaction. This is a drive-by availability impact. The fix for this vulnerability is to update to Ray 2.54.0 or higher.
Weakness: CWE-396
Which versions are affected by CVE-2026-27482?
3 open source packages ship an affected version, including ray. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
ray PyPI | All versions | 2.54.0 |
ray PyPI | All versions | 2.54.0 |
ray PyPI | All versions | 2.54.0 |
Products include Anyscale Ray.
How do I fix CVE-2026-27482?
Upgrade ray to 2.54.0 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-27482 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-27482 exists.
Other vulnerabilities in ray-project ray
- CVE-2025-62593 Ray-Project Ray Code Injection
- CVE-2023-48022 Ray has arbitrary code execution via jobs submission API
- CVE-2023-48023 Server-side request forgery in n/a
- CVE-2026-41486 Ray: Remote Code Execution via Parquet Arrow Extension Type Deserialization
- CVE-2026-32981 Ray Dashboard <= 2.8.0 Path Traversal Leading to Local File Disclosure
Sources
Also known as ECHO-0e02-c16f-6496, GHSA-q5fh-2hc8-f6rq, MINI-cv95-83v9-fqmc, MINI-hf8g-882v-x575, PYSEC-2026-2271.