CVE-2026-27482: Ray: Dashboard DELETE endpoints allow unauthenticated browser-triggered DoS (Serve shutdown / job deletion)
Summary
Ray’s dashboard HTTP server blocks browser-origin POST/PUT but does not cover DELETE, and key DELETE endpoints are unauthenticated by default. If the dashboard/agent is reachable (e.g., --dashboard-host=0.0.0.0), a web page via DNS rebinding or same-network access can issue DELETE requests that shut down Serve or delete jobs without user interaction. This is a drive-by availability impact.
### Details
- Middleware: python/ray/dashboard/httpserverhead.py#getbrowsersnopostputmiddleware only checks POST/PUT via isbrowserrequest (UA/Origin/Sec-Fetch heuristics). DELETE is not gated. - Endpoints lacking browser protection/auth by default: - python/ray/dashboard/modules/serve/servehead.py: @routes.delete("/api/serve/applications/") calls serve.shutdown(). - python/ray/dashboard/modules/job/jobhead.py: @routes.delete("/api/jobs/{joborsubmissionid}"). - python/ray/dashboard/modules/job/jobagent.py: @routes.delete("/api/jobagent/jobs/{joborsubmissionid}") (not wrapped with denybrowserrequests either). - Dashboard token auth is optional and off by default; binding to 0.0.0.0 is common for remote access.
### PoC
Prereqs: dashboard reachable (e.g., ray start --head --dashboard-host=0.0.0.0), no token auth.
1. Start Serve (or have jobs present). 2. From any browser-reachable origin (DNS rebinding or same-LAN page), issue a DELETE fetch:
fetch("http://<dashboard-host>:8265/api/serve/applications/", { method: "DELETE", headers: { "User-Agent": "Mozilla/5.0" } // browsers set this automatically });
Result: Serve shuts down. 3) Similarly, delete jobs:
fetch("http://<dashboard-host>:8265/api/jobs/<joborsubmissionid>", { method: "DELETE" }); fetch("http://<dashboard-agent>:52365/api/jobagent/jobs/<joborsubmissionid>", { method: "DELETE" });
Browsers will send the Mozilla UA and Origin/Sec-Fetch headers, but DELETE is not blocked by the middleware, so the requests succeed.
### Impact
- Availability loss: Serve shutdown; job deletion. Triggerable via drive-by browser requests if the dashboard/agent ports are reachable and auth is disabled (default). - No code execution from this vector, but breaks isolation/trust assumptions for “developer-only” endpoints. Fix The fix for this vulnerability is to update to Ray 2.54.0 or higher.
Fix PR: https://github.com/ray-project/ray/pull/60526
Other sources
Ray is an AI compute engine. In versions 2.53.0 and below, thedashboard HTTP server blocks browser-origin POST/PUT but does not cover DELETE, and key DELETE endpoints are unauthenticated by default. If the dashboard/agent is reachable (e.g., --dashboard-host=0.0.0.0), a web page via DNS rebinding or same-network access can issue DELETE requests that shut down Serve or delete jobs without user interaction. This is a drive-by availability impact. The fix for this vulnerability is to update to Ray 2.54.0 or higher.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27482?
CVE-2026-27482 is considered a high-severity vulnerability due to the risk of unauthorized DELETE operations on sensitive resources.
How do I fix CVE-2026-27482?
To fix CVE-2026-27482, ensure that proper authentication is implemented for the DELETE endpoints in the Ray dashboard.
What are the potential impacts of CVE-2026-27482?
The potential impacts of CVE-2026-27482 include unauthorized deletion of data, which could lead to data loss and service disruption.
Which versions of Ray are affected by CVE-2026-27482?
CVE-2026-27482 affects versions of Ray prior to 2.54.0.
How can I determine if my Ray dashboard is exposed to CVE-2026-27482?
You can determine exposure by checking if your Ray dashboard is accessible on a public network without proper authentication mechanisms in place.