CVE-2026-27482: 
Wolfi vulnerability analysis and mitigation

CVE-2026-27482 is a missing authentication vulnerability in the Ray AI compute engine's dashboard HTTP server that allows unauthenticated browser-triggered denial-of-service via DELETE requests. The existing middleware (get_browsers_no_post_put_middleware) only blocked POST and PUT methods from browser origins, leaving DELETE endpoints unprotected. Affected versions are all Ray releases below 2.54.0 (i.e., ≤ 2.53.0). The vulnerability was disclosed on February 20, 2026, and carries a CVSS v3.1 base score of 5.9 (Moderate) per the GitHub Advisory, or 6.5 (High) per Feedly's estimate (GitHub Advisory, Ray Security Advisory).

The root cause is CWE-306 (Missing Authentication for Critical Function) — key DELETE endpoints in the Ray dashboard are unauthenticated by default, and the browser-origin protection middleware only covered POST and PUT methods. Specifically, python/ray/dashboard/http_server_head.py's get_browsers_no_post_put_middleware used User-Agent, Origin, and Sec-Fetch heuristics to identify browser requests but only blocked POST and PUT, leaving DELETE unguarded. Three critical endpoints were exposed: DELETE /api/serve/applications/ (triggers serve.shutdown()), DELETE /api/jobs/{job_or_submission_id} (deletes jobs via job_head), and DELETE /api/job_agent/jobs/{job_or_submission_id} (deletes jobs via job_agent). Dashboard token authentication is optional and disabled by default, and binding to 0.0.0.0 is common for remote access scenarios, making exploitation straightforward when the dashboard is network-accessible (GitHub Advisory, Fix PR).

Successful exploitation results in availability loss — an attacker can remotely shut down Ray Serve applications or delete running/queued jobs without any authentication. There is no confidentiality impact (no data exfiltration) and only low integrity impact (job records are deleted). The attack breaks the "developer-only" isolation assumption for dashboard endpoints and can disrupt AI/ML workloads running on the affected Ray cluster, potentially causing significant operational disruption in production environments (GitHub Advisory, Ray Security Advisory).

A proof-of-concept exploit is publicly documented in the GitHub Security Advisory itself, demonstrating how a browser-based fetch() call with a DELETE method can trigger Serve shutdown or job deletion. No privileges are required, though the attack requires either DNS rebinding or same-network access to the dashboard port (typically 8265 or 52365), which raises the attack complexity. There is no evidence of active in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.061% (19th percentile), indicating low near-term exploitation probability (GitHub Advisory, Ray Security Advisory).

1. Reconnaissance: Identify Ray dashboard instances accessible from the network using port scanning (default port 8265 for the dashboard head, 52365 for the job agent). Confirm the target is running Ray ≤ 2.53.0 and that --dashboard-host=0.0.0.0 is configured (common for remote access).
2. Verify no token auth: Confirm that dashboard token authentication is not enabled (it is off by default). A simple GET http://<target>:8265/api/jobs/ should return a 200 response without an Authorization header.
3. DNS rebinding or same-network positioning: Position the attacker-controlled web page to be reachable from the same network as the Ray dashboard, or set up a DNS rebinding attack to make the browser resolve the attacker's domain to the Ray dashboard IP.
4. Issue malicious DELETE request (Serve shutdown): From a browser visiting the attacker-controlled page, execute the following JavaScript to shut down Ray Serve:

fetch("http://<ray-host>:8265/api/serve/applications/", {
  method: "DELETE",
  headers: { "User-Agent": "Mozilla/5.0" }
});

5. Issue malicious DELETE request (job deletion): To delete a specific job, issue:

fetch("http://<ray-host>:8265/api/jobs/<job_id>", { method: "DELETE" });
fetch("http://<ray-host>:52365/api/job_agent/jobs/<job_id>", { method: "DELETE" });

6. Confirm impact: The browser sends the Mozilla UA and Origin/Sec-Fetch headers automatically; since DELETE is not blocked by the middleware, the requests succeed and Serve shuts down or jobs are deleted (GitHub Advisory, Ray Security Advisory).

• Network: Unexpected HTTP DELETE requests to Ray dashboard port (default 8265) targeting /api/serve/applications/, /api/jobs/<id>, or job agent port (default 52365) targeting /api/job_agent/jobs/<id>; DELETE requests originating from browser-like User-Agent strings (e.g., Mozilla/5.0) with Origin or Sec-Fetch-* headers.
• Logs: Ray dashboard access logs showing DELETE method requests to the above endpoints returning HTTP 200 responses; sudden serve.shutdown() events in Ray Serve logs without corresponding operator action; job deletion events in Ray job logs without matching CLI/API activity.
• Process/Application: Unexpected termination of Ray Serve applications or disappearance of running jobs from the Ray dashboard; Ray Serve actors stopping without a graceful shutdown initiated by an authorized user (GitHub Advisory).

The primary fix is to upgrade Ray to version 2.54.0 or higher, which switches the browser-origin middleware from a blocklist (POST/PUT only) to an allowlist (GET/HEAD/OPTIONS only), blocking DELETE, PATCH, and any future HTTP mutation methods from browser origins by default (Ray 2.54.0 Release, Fix PR). If immediate patching is not possible, apply the following workarounds:

• Restrict network access: Use firewall rules to limit access to the Ray dashboard ports (8265, 52365) to trusted IP ranges only.
• Avoid --dashboard-host=0.0.0.0: Do not expose the dashboard to untrusted networks; bind only to localhost or a trusted interface.
• Enable token authentication: Configure Ray dashboard token authentication to require an Authorization header for all API requests.

The vulnerability was reported by security researcher qi-scape and published by x01-emre to the Ray project's GitHub Security Advisories on February 20, 2026. The fix PR (#60526) was reviewed and merged by Ray core maintainer edoakes on January 27, 2026 (prior to the public advisory), with a follow-up style cleanup PR (#60544) merged the next day. A blog post on dev.to discussed the vulnerability in the context of agentic AI attack surfaces, highlighting it as an example of classic web security issues resurfacing in AI infrastructure (GitHub Advisory, Fix PR).