{"data":{"id":"f7b3d095-f976-4909-ba8a-9a10b7e1e9f0","title":"GHSA-q5fh-2hc8-f6rq: Ray dashboard DELETE endpoints allow unauthenticated browser-triggered DoS (Serve shutdown / job deletion)","summary":"Ray's dashboard HTTP server blocks browser-origin POST and PUT requests through the get_browsers_no_post_put_middleware, but leaves DELETE unchecked. Several DELETE endpoints, including /api/serve/applications/ (which calls serve.shutdown()) and the job deletion routes on the dashboard and job agent, lack browser protection and authentication by default. If the dashboard is reachable, for example when bound to 0.0.0.0 with token auth disabled, a web page via DNS rebinding or a same-network page can shut down Serve or delete jobs without user interaction, causing an availability loss.","solution":"Fixed in Ray 2.54.0 or higher.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-q5fh-2hc8-f6rq","publishedAt":"2026-02-20T21:15:25.000Z","cveId":"CVE-2026-27482","cweIds":null,"cvssScore":null,"cvssSeverity":"medium","severity":"medium","attackType":["denial_of_service"],"issueType":"vulnerability","affectedPackages":["ray@< 2.54.0 (fixed: 2.54.0)"],"affectedPackageNames":["ray"],"affectedPackageRefs":["pypi:ray"],"affectedVendors":[],"affectedVendorsRaw":["Ray"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00307,"epssCheckedAt":"2026-11-04T06:10:13.820Z","kevDateAdded":null,"advisoryAliases":["GHSA-q5fh-2hc8-f6rq"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":null,"fixReleasedAt":"2026-02-18T04:04:35.409Z","daysToFix":-2,"fixCheckedAt":"2026-10-29T21:40:45.622Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["availability"],"aiComponentTargeted":"inference","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"ray","fixedVersion":"2.54.0","matchedVersion":"2.54.0","fixReleasedAt":"2026-02-18T04:04:35.409Z","daysToFix":-2,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:40:45.475Z"}]}}