CVE-2026-27482

Katalog CVE

CVSS 6.5 · Medium EPSS 0,41%

Kerentanan Declaration of Catch for Generic Exception pada anyscale ray. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

Ray is an AI compute engine. In versions 2.53.0 and below, thedashboard HTTP server blocks browser-origin POST/PUT but does not cover DELETE, and key DELETE endpoints are unauthenticated by default. If the dashboard/agent is reachable (e.g., --dashboard-host=0.0.0.0), a web page via DNS rebinding or same-network access can issue DELETE requests that shut down Serve or delete jobs without user interaction. This is a drive-by availability impact. The fix for this vulnerability is to update to Ray 2.54.0 or higher.

Rincian

Terbit di NVD

21 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-396: Declaration of Catch for Generic Exception

EPSS (30 hari)

0,41% peluang dieksploitasi; lebih tinggi dari 33,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/ray-project/ray/security/advisories/GHSA-q5fh-2hc8-f6rq exploit · advisory vendor
• https://github.com/ray-project/ray/commit/0fda8b824cdc9dc6edd763bb28dfd7d1cc9b02a4 patch
• https://github.com/ray-project/ray/pull/60526 issue tracking · patch
• https://github.com/ray-project/ray/releases/tag/ray-2.54.0 product · release notes