CVE-2026-27482: Ray Package Unauthenticated DELETE Endpoints Allow Browser-Triggered DoS
Summary
CVE-2026-27482: Ray’s dashboard HTTP server blocks browser-origin POST/PUT but does not cover DELETE, and key DELETE endpoints are unauthenticated by default. Affects ray versions < 2.54.0. Fixed in 2.54.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ray is an open-source framework designed for building and running distributed applications. It provides a unified interface for managing resources and executing tasks across a cluster of machines. The Ray dashboard offers a web-based interface for monitoring and managing Ray applications. However, due to a security oversight, certain DELETE endpoints in the Ray dashboard are unauthenticated by default, exposing users to potential denial-of-service (DoS) attacks.
Vulnerability Detail
The vulnerability arises from the Ray dashboard's HTTP server, which blocks browser-originated POST and PUT requests but does not apply the same restrictions to DELETE requests. Key DELETE endpoints, such as those for shutting down the Serve component or deleting jobs, are accessible without authentication. This flaw can be exploited by an attacker who can reach the dashboard, either through DNS rebinding or being on the same network, allowing them to issue DELETE requests that can disrupt service availability. The lack of authentication on these endpoints poses a significant risk, as it can lead to unintended service shutdowns and job deletions.
How To Fix
Latest published version: 2.59.0 as of 23 Oct 2026
pip install --upgrade "ray==2.59.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.54.0
This is the first release that contains the fix.
pip install --upgrade "ray==2.54.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict access to the Ray dashboard by binding it to a specific IP address instead of using '0.0.0.0', which allows access from any network interface. Additionally, enabling token authentication can help secure the DELETE endpoints.
Conclusion
CVE-2026-27482 highlights a significant security oversight in the Ray package, where unauthenticated DELETE endpoints can be exploited to cause service disruptions. Users are strongly advised to update to the latest version to protect against this vulnerability and consider implementing additional security measures in the meantime.
See every vulnerability recorded for ray →
FAQ
CVE-2026-27482 is a vulnerability in the Ray package that allows unauthenticated DELETE requests to certain endpoints, potentially leading to denial-of-service attacks.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit the Vulert playground at Vulert Scanner to analyze your application.
The main consequence is the potential for service disruption, as unauthorized users can shut down the Serve component or delete jobs without any authentication.
Yes, the vulnerability has been patched in Ray version 2.54.0 and higher. Users should update to this version to mitigate the risk.
If immediate updating is not possible, consider restricting access to the dashboard and enabling token authentication as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for ray.
