Ray Missing Authorization vulnerability

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2023-6020 · ADVISORY
• ray-project/ray · WEB
• ray-project/ray release ray-2.8.1 · WEB
• huntr.com/bounties/83dd8619-6dc3-4c98-8f1b-e620fedcd1f6 · WEB
• anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023 · WEB
• pypi.org/project/ray · PACKAGE
• GitHub Advisory GHSA-6cxr-8q3m-jwrr · ADVISORY

ray のその他の脆弱性

• CVE-2026-57516高 8.8Ray prior to 2.56.0 contains an unsafe deserialization vulnerability in the WebDataset reader that allows attackers to achieve remote code e…
• CVE-2026-41486高 8.8Ray is an AI compute engine. From version 2.54.0 to before version 2.55.0, Ray Data registers custom Arrow extension types (ray.data.arrow_t…
• CVE-2026-32981高 7.5A path traversal vulnerability was identified in Ray Dashboard (default port 8265) in Ray versions prior to 2.8.1. Due to improper validatio…
• CVE-2026-27482中 6.5Ray is an AI compute engine. In versions 2.53.0 and below, thedashboard HTTP server blocks browser-origin POST/PUT but does not cover DELETE…
• CVE-2025-62593高 8.8悪用確認済み（CISA KEV）Ray is an AI compute engine. Prior to version 2.52.0, developers working with Ray as a development tool can be exploited via a critical RCE …