CVE-2023-48022
CRITICALVulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2021 - Server-Side Request Forgery
ASVS 5.0
V12 - Files and Resources SSRF prevention, URL validation
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS 9.8, EPSS 92.2%, PoC available. Thousands of Ray clusters have been found exposed on the internet. The ShadowRay campaign (2024) compromised production AI/ML environments to steal model weights, training data, and cloud credentials. The 'disputed' status causes many organizations to deprioritize patching. |
| Exploit ScenarioDerived | An attacker scans for exposed Ray dashboards on port 8265. Finding an unprotected cluster, they submit a job via the REST API that exfiltrates AWS credentials from the instance metadata service, steals ML model weights from the shared object store, and deploys a cryptominer across all worker nodes. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 26, 2026
Anyscale Ray 2.6.3 and 2.8.0 expose an unauthenticated job submission API that allows remote code execution by design. The vendor considers this expected behavior for a compute framework intended for trusted network environments, but internet-exposed Ray clusters are actively exploited by cryptominers and data exfiltration campaigns.
Earlier versions of this analysis (1)
Ray's unauthenticated job submission API enables RCE by design, creating critical risk when clusters are inadvertently exposed to the internet.
RemediationAI
Never expose Ray clusters to the internet. Place Ray behind a VPN or private network with strict access controls. Enable Ray's authentication features if available in newer versions. Monitor Ray job submission logs for unexpected workloads. Audit cloud security groups for port 8265 exposure.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Ray is a distributed computing framework for ML/AI workloads. The dashboard (port 8265) and job submission API intentionally allow unauthenticated code execution as this is the framework's core functionality. The vendor explicitly states Ray is not designed for untrusted network exposure. However, cloud misconfigurations frequently expose Ray clusters to the internet, and the API accepts arbitrary Python code execution.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Anyscale Ray 2.6.3 and 2.8.0 allows a remote attacker to execute arbitrary code via the job submission API. NOTE: the vendor's position is that this report is irrelevant because Ray, as stated in its documentation, is not intended for use outside of a strictly controlled network environment. (Also, within that environment, customers at version 2.52.0 and later can choose to use token authentication.)
Executive ViewAI
Organizations using Anyscale Ray 2.6.3 and 2.8.0 face critical risk from CVE-2023-48022, a server-side request forgery vulnerability rated CVSS 9.8. Attackers could trick authenticated users into performing unintended actions, potentially modifying critical settings or data. With an EPSS score of 92%, this vulnerability faces very high likelihood of exploitation. Organizations should apply vendor updates immediately when available and implement compensating controls in the interim.
Apply vendor patch. If immediate patching is not feasible: (1) Implement strict egress filtering; (2) Use allowlists for outbound connections; (3) Block access to cloud metadata endpoints.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
GitHub PoC
Exploit-DB