GHSA-gx77-xgc2-4888 json
Ray's New Token Authentication is Disabled By Default
published 11mo ago modified 2mo ago also CVE-2025-34351 , PYSEC-2026-518
- cvss
- —
- not scored
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no score, EPSS covers CVEs only
- public exploits
- 0
- none known
Summary
Anyscale Ray 2.52.0 contains an insecure default configuration in which token-based authentication for Ray management interfaces (including the dashboard and Jobs API) is disabled unless explicitly enabled by setting RAY_AUTH_MODE=token. In the default unauthenticated state, a remote attacker with network access to these interfaces can submit jobs and execute arbitrary code on the Ray cluster. NOTE: The vendor plans to enable token authentication by default in a future release. They recommend enabling token authentication to protect your cluster from unauthorized access.
Patch / fix
Is GHSA-gx77-xgc2-4888 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerAffected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | ray | <=2.52.0 |
no fix listed |
Classification
References
-
github.com
/JLLeitschuh/security-research/security/advisories/GHSA-w8vc-465m-jjw6
web
-
nvd.nist.gov
/vuln/detail/CVE-2025-34351
advisory
-
docs.ray.io
/en/latest/ray-security/token-auth.html
web
-
github.com
/ray-project/ray
package
-
github.com
/ray-project/ray/releases/tag/ray-2.52.0
web
-
cve.org
/resourcessupport/allresources/cnarules#section_4-1_Vulnerability_Determination
web
-
linkedin.com
/posts/jonathan-leitschuh_the-latest-piece-of-mind-bending-research-activity-7396976425997606912-qizE
web
-
oligo.security
/blog/shadowray-2-0-attackers-turn-ai-against-itself-in-global-campaign-that-hijacks-ai-into-self-propagating-
web
-
oligo.security
/blog/shadowray-attack-ai-workloads-actively-exploited-in-the-wild
web
-
vulncheck.com
/advisories/anyscale-ray-token-authentication-disabled-by-default-insecure-configuration
web
-
pypi.org
/project/ray
package
-
github.com
/advisories/GHSA-gx77-xgc2-4888
advisory
Sources
- GitHub Advisory GHSA-gx77-xgc2-4888
- OSV PYSEC-2026-518
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.