CVE-2023-6021: Ray Path Traversal Vulnerability in Ray Package
Summary
CVE-2023-6021: Ray Path Traversal vulnerability. Affects ray versions < 2.8.1. Fixed in 2.8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Ray is an open-source framework designed for building and running distributed applications. It provides a simple interface for parallel and distributed computing, enabling users to scale their applications seamlessly. However, Ray has been found to have a vulnerability that allows unauthorized access to sensitive files on the server, posing a significant security risk.
Vulnerability Detail
The vulnerability identified as CVE-2023-6021 is a Local File Inclusion (LFI) issue in Ray's log API endpoint. This flaw allows attackers to read any file on the server without requiring authentication. The potential ramifications of this vulnerability include exposure of sensitive information, unauthorized access to system files, and the possibility of further exploitation of the server. The vulnerability exists in versions prior to 2.8.1, and it is critical for users to address this issue promptly to safeguard their systems.
How To Fix
Latest published version: 2.59.0 as of 23 Oct 2026
pip install --upgrade "ray==2.59.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.8.1
This is the first release that contains the fix.
pip install --upgrade "ray==2.8.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the log API endpoint or implement additional authentication measures to prevent unauthorized access until the package is updated. However, this is not a permanent solution and should be followed by an update to the patched version.
Conclusion
CVE-2023-6021 represents a significant security vulnerability in the Ray package, allowing unauthorized file access through its log API endpoint. Users are strongly advised to update to version 2.8.1 or later to mitigate this risk. Temporary workarounds can be implemented, but they should not replace the need for an update.
See every vulnerability recorded for ray →
FAQ
CVE-2023-6021 is a vulnerability in the Ray package that allows unauthorized access to files on the server through its log API endpoint.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score for CVE-2023-6021 is 9.3, indicating a critical level of severity.
If an immediate update is not possible, implement access restrictions to the log API endpoint as a temporary workaround.
More information can be found in the Ray maintainers' response at https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023.
References
Related vulnerabilities
Recent vulnerabilities recorded for ray.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
