GHSA-q5fh-2hc8-f6rq: Ray dashboard DELETE endpoints allow unauthenticated browser-triggered DoS (Serve shutdown / job deletion)
- Identifiers
- CVE-2026-27482GHSA-q5fh-2hc8-f6rq
- Published
- Record updated
- Affected
- ray < 2.54.0
- Fixed in
- 2.54.0
- released February 17, 2026, 2 days before disclosure
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.3%
Summary
Ray's dashboard HTTP server blocks browser-origin POST and PUT requests through the get_browsers_no_post_put_middleware, but leaves DELETE unchecked. Several DELETE endpoints, including /api/serve/applications/ (which calls serve.shutdown()) and the job deletion routes on the dashboard and job agent, lack browser protection and authentication by default. If the dashboard is reachable, for example when bound to 0.0.0.0 with token auth disabled, a web page via DNS rebinding or a same-network page can shut down Serve or delete jobs without user interaction, causing an availability loss.
Mitigation
Fixed in Ray 2.54.0 or higher.
Affected packages in the Exposure Registry
Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.
- rayPyPINo LLM dependency detected · 22 tracked dependents
Related items
- LowCloakFEM: Agentic FEM Code Generation for Red-Teaming Computational Resource ExhaustionSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
- MediumThe Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model ResourcesSimilar attack · Google Threat Intelligence
- InfoThe Blind Spots of Detection: Adversarial Perturbation Attacks against Watchdogs in Distributed LLM InferenceSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
- HighCVE-2026-118761: Kubeflow Pipelines decompression bomb in pipeline archive uploadSimilar attack · NVD/CVE Database
- LowOpenCode User Hit with Hostile Backlash After Reporting Free AI LoopholeSimilar attack · Socket Blog