CVE-2026-27482

Ray is an AI compute engine. In versions 2.53.0 and below, thedashboard HTTP server blocks browser-origin POST/PUT but does not cover DELETE, and key DELETE endpoints are unauthenticated by default. If the dashboard/agent is reachable (e.g., --dashboard-host=0.0.0.0), a web page via DNS rebinding or same-network access can issue DELETE requests that shut down Serve or delete jobs without user interaction. This is a drive-by availability impact. The fix for this vulnerability is to update to Ray 2.54.0 or higher.

• CWE-396

• https://github.com/ray-project/ray/commit/0fda8b824cdc9dc6edd763bb28dfd7d1cc9b02a4Patch
• https://github.com/ray-project/ray/pull/60526Issue Tracking, Patch
• https://github.com/ray-project/ray/releases/tag/ray-2.54.0Product, Release Notes
• https://github.com/ray-project/ray/security/advisories/GHSA-q5fh-2hc8-f6rqExploit, Vendor Advisory

Published

Feb 21, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-27477Mastodon is a free, open-source social network server based …5.9
• CVE-2026-27478Unity Catalog is an open, multi-modal Catalog for data and A…9.1
• CVE-2026-27479Wallos is an open-source, self-hostable personal subscriptio…7.7
• CVE-2026-2748SEPPmail Secure Email Gateway before version 15.0.1 improper…5.3
• CVE-2026-27480Static Web Server (SWS) is a production-ready web server sui…5.3
• CVE-2026-27481Discourse is an open-source discussion platform. From versio…5.3
• CVE-2026-27483MindsDB is a platform for building artificial intelligence f…8.8
• CVE-2026-27484OpenClaw is a personal AI assistant. In versions 2026.2.17 a…4.3
• CVE-2026-27485OpenClaw is a personal AI assistant. In versions 2026.2.17 a…4.4
• CVE-2026-27486OpenClaw is a personal AI assistant. In versions 2026.2.13 a…5.3
• CVE-2026-27487OpenClaw is a personal AI assistant. In versions 2026.2.13 a…8
• CVE-2026-27488OpenClaw is a personal AI assistant. In versions 2026.2.17 a…7.3