AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

RayGHSA-6cxr-8q3m-jwrr

Ray Missing Authorization vulnerability

Ray

CVE-2023-6020 · Published Nov 16, 2023 · updated Sep 10, 2026

Critical9.3
Fix: upgrade to 2.8.1 or later
GitHub advisory

LFI in Ray's /static/ directory allows attackers to read any file on the server without authentication. The issue is fixed in version 2.8.1+. Ray maintainers response can be found here: https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023

Affected versions

PackageAffectedFixed in
ray
PyPI
< 2.8.12.8.1
Details and references
CVSS 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-598, CWE-862
Also known as
CVE-2023-6020, PYSEC-2026-516

More Ray advisories

All Ray
CriticalNov 27, 2025Ray's New Token Authentication is Disabled By DefaultCVE-2025-34351no fix yetCriticalNov 26, 2025Ray is vulnerable to Critical RCE via Safari & Firefox Browsers through DNS Rebinding AttackCVE-2025-62593fixed in 2.52.0Medium 6.4Mar 6, 2025ray vulnerable to Insertion of Sensitive Information into Log FileCVE-2025-1979fixed in 2.43.0Critical 9.8Nov 28, 2023Ray has arbitrary code execution via jobs submission APICVE-2023-48022no fix yetCritical 9.3Nov 16, 2023Ray Path Traversal vulnerabilityCVE-2023-6021fixed in 2.8.1Critical 9.8Nov 16, 2023Ray OS Command Injection vulnerabilityCVE-2023-6019fixed in 2.8.1