Advisoriesby Ibis
Ray security advisories
11 advisories · 5 critical or high in 12 months · latest Jul 24
11 advisories
Ray: unsafe deserializationCVE-2026-57516fixed in 2.56.0Ray: Remote Code Execution via Parquet Arrow Extension Type DeserializationCVE-2026-41486fixed in 2.55.0Ray Dashboard is vulnerable to path traversal through its static file handling mechanismCVE-2026-32981fixed in 2.8.1Ray dashboard DELETE endpoints allow unauthenticated browser-triggered DoS (Serve shutdown / job deletion)CVE-2026-27482fixed in 2.54.0Ray's New Token Authentication is Disabled By DefaultCVE-2025-34351no fix yetRay is vulnerable to Critical RCE via Safari & Firefox Browsers through DNS Rebinding AttackCVE-2025-62593fixed in 2.52.0ray vulnerable to Insertion of Sensitive Information into Log FileCVE-2025-1979fixed in 2.43.0Ray has arbitrary code execution via jobs submission APICVE-2023-48022no fix yetRay Missing Authorization vulnerabilityCVE-2023-6020fixed in 2.8.1Ray Path Traversal vulnerabilityCVE-2023-6021fixed in 2.8.1Ray OS Command Injection vulnerabilityCVE-2023-6019fixed in 2.8.1