Ray's New Token Authentication is Disabled By Default
Anyscale Ray 2.52.0 contains an insecure default configuration in which token-based authentication for Ray management interfaces (including the dashboard and Jobs API) is disabled unless explicitly enabled by setting RAY_AUTH_MODE=token. In the default unauthenticated state, a remote attacker with network access to these interfaces can submit jobs and execute arbitrary code on the Ray cluster. NOTE: The vendor plans to enable token authentication by default in a future release. They recommend enabling token authentication to protect your cluster from unauthorized access.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | ray | <= 2.52.0 | no fix |
References
- https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-w8vc-465m-jjw6
- https://nvd.nist.gov/vuln/detail/CVE-2025-34351
- https://docs.ray.io/en/latest/ray-security/token-auth.html
- https://github.com/ray-project/ray
- https://github.com/ray-project/ray/releases/tag/ray-2.52.0
- https://www.cve.org/resourcessupport/allresources/cnarules#section_4-1_Vulnerability_Determination
- https://www.linkedin.com/posts/jonathan-leitschuh_the-latest-piece-of-mind-bending-research-activity-7396976425997606912-qizE
- https://www.oligo.security/blog/shadowray-2-0-attackers-turn-ai-against-itself-in-global-campaign-that-hijacks-ai-into-self-propagating-botnet
- https://www.oligo.security/blog/shadowray-attack-ai-workloads-actively-exploited-in-the-wild
- https://www.vulncheck.com/advisories/anyscale-ray-token-authentication-disabled-by-default-insecure-configuration
- https://pypi.org/project/ray
- https://github.com/advisories/GHSA-gx77-xgc2-4888
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N- Weakness (CWE)
CWE-1188, CWE-304- Platform
- Python (PyPI)
- Package
ray- Disclosed
- 27.11.2025
- Updated
- 11.10.2026 15:17
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2026-518 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-gx77-xgc2-4888 - CC BY 4.0
Vulnerability history: ray
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 11
- First → latest
- 11.2023 07.2026
- Without a fix
- 2
- Exploited in attacks
- 1
Severity breakdown
- Critical 6
- High 3
- Medium 2
Disclosures per year
- 2023: 4
- 2024: 0
- 2025: 3
- 2026: 4
-
Ray's New Token Authentication is Disabled By Default this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.