GHSA-q5fh-2hc8-f6rq
Medium · 5.9CVSS
5.9
EPSS
—
Published
Feb 20, 2026
CISA due date
—
The record
Ray dashboard DELETE endpoints allow unauthenticated browser-triggered DoS (Serve shutdown / job deletion)
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | ray | 0 | 2.54.0 |
Related vulnerabilities
- CVE-2026-27482 Ray is an AI compute engine. Same vulnerability
- CVE-2025-34351 Ray's New Token Authentication is Disabled By Default Also affects ray
- CVE-2025-62593 Ray is an AI compute engine. Also affects ray
- CVE-2023-6020 LFI in Ray's /static/ directory allows attackers to read any file on the server without… Also affects ray
- CVE-2023-6021 LFI in Ray's log API endpoint allows attackers to read any file on the server without… Also affects ray
- CVE-2023-6019 A command injection existed in Ray's cpu_profile URL parameter allowing attackers to… Also affects ray
- CVE-2026-114636 Traefik v3.7.13 before v3.7.14 contains an access-control bypass in the Kubernetes… CWE-306
- CVE-2026-112104 A flaw has been found in eremef bandcamp-player up to 1.8.33-beta. CWE-306