CVE-2023-6020: Ray Missing Authorization vulnerability
Summary
CVE-2023-6020: Ray Missing Authorization vulnerability. Affects ray versions < 2.8.1. Fixed in 2.8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ray is a Python package available on PyPI that provides a simple and efficient framework for building distributed applications. It allows users to easily parallelize and scale their Python code across multiple machines. Ray's functionality includes task scheduling, distributed data storage, and distributed computing. However, a vulnerability has been identified in Ray's /static/ directory that allows attackers to read any file on the server without authentication.
Vulnerability Detail
The vulnerability in Ray's /static/ directory is a Local File Inclusion (LFI) vulnerability. This means that an attacker can exploit this vulnerability to access sensitive files on the server that should not be accessible without proper authorization. By manipulating the file path in the request, an attacker can traverse the directory structure and read arbitrary files. This can lead to unauthorized access to sensitive information, such as configuration files, credentials, or other sensitive data stored on the server. The impact of this vulnerability can be severe, as it allows an attacker to bypass authentication and gain unauthorized access to sensitive data.
How To Fix
Latest published version: 2.59.0 as of 23 Oct 2026
pip install --upgrade "ray==2.59.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.8.1
This is the first release that contains the fix.
pip install --upgrade "ray==2.8.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the /static/ directory by configuring proper file permissions and access controls. By limiting access to this directory, the risk of unauthorized file access can be mitigated. However, this is not a permanent solution and should be used in conjunction with upgrading to a patched version of Ray.
Conclusion
In conclusion, the Ray Missing Authorization vulnerability allows attackers to read any file on the server without authentication. This can lead to unauthorized access to sensitive information and poses a significant security risk. It is recommended to upgrade to the latest version of Ray (2.6.4) to fix this vulnerability. Additionally, restricting access to the /static/ directory can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ray →
FAQ
The impact of this vulnerability is severe, as it allows an attacker to bypass authentication and gain unauthorized access to sensitive data on the server.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, and you can check the impact of this vulnerability without any signup or installation.
Yes, a fix is available for this vulnerability. Users should upgrade their Ray installation to the latest version (2.6.4) to ensure they are protected against this vulnerability.
As a temporary workaround, users can restrict access to the /static/ directory by configuring proper file permissions and access controls. However, this should be used in conjunction with upgrading to a patched version of Ray.
The CVSS score of this vulnerability is 9.3, indicating a critical severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for ray.
