PyPI/ray CVE-2026-27482: medium 5.9, EPSS 0.46%

Ray dashboard DELETE endpoints allow unauthenticated browser-triggered DoS (Serve shutdown / job deletion)

Action: Upgrade ray to 2.54.0 or later.

pip install ray==2.54.0

Affected

Fixed versions

Sources

• osv: GHSA-q5fh-2hc8-f6rq
• https://github.com/ray-project/ray/security/advisories/GHSA-q5fh-2hc8-f6rq
• https://nvd.nist.gov/vuln/detail/CVE-2026-27482
• https://github.com/ray-project/ray/pull/60526
• https://github.com/ray-project/ray/commit/0fda8b824cdc9dc6edd763bb28dfd7d1cc9b02a4
• https://github.com/ray-project/ray
• https://github.com/ray-project/ray/releases/tag/ray-2.54.0

CVE-2026-27482 · published 2026-02-20T21:15:25Z · modified 2026-09-10T03:50:59.596811106Z · JSON