LLM-on-Ray CVE-2026-28707

Exploitation requires all of the following concurrently: (1) local access to the system running LLM-on-Ray before version 1.0; (2) a privileged user (PR:H) must be present and passively interacting with the system - passive user interaction (UI:P in CVSS 4.0) means a legitimate privileged user performing normal operations, not an explicitly triggered action; (3) specific attack requirements (AT:P) must be met, meaning non-default conditions or a particular runtime state of LLM-on-Ray must be present - the exact condition is not detailed in the available description, but the AT:P designation confirms that default deployments without the triggering condition are not automatically exploitable. Exploitation is not possible remotely, and requires a pre-existing foothold or co-location on the target system. The AT:P condition and PR:H requirement together meaningfully constrain real-world exploitation beyond what the high C/I/A scores alone suggest.

The provided CVSS 4.0 score of 5.4 reflects the meaningful constraints on exploitation: AV:L (local access only), PR:H (high privileges required), UI:P (passive user interaction needed), and AT:P (specific attack requirements must be present). Despite the High impacts on VC/VI/VA, these prerequisites substantially reduce real-world exploitability. EPSS data was not provided, and the vulnerability is absent from the CISA KEV catalog, suggesting no confirmed or widespread active exploitation. The combination of local-only access, high privilege requirement, passive user interaction, and specific attack conditions (AT:P) means this is not a remotely exploitable opportunistic threat. It is most relevant to environments where LLM-on-Ray is deployed with multiple users or shared privileged accounts. The high C/I/A impact on the vulnerable system is concerning if prerequisites are met, but defenders with properly segmented access controls and principle-of-least-privilege are at substantially lower risk. No CVSS 3.1 vector was provided in the source data - the 4.0 vector is the authoritative scoring.

A local attacker - or malicious process running in Ring 3 user space - operating on a system where a privileged user is actively or passively using LLM-on-Ray could exploit the protection mechanism failure to manipulate the privileged user's execution context, escalating their own access. Because AT:P applies, specific attack conditions (such as a particular runtime state or configuration of LLM-on-Ray) must be present alongside the privileged user interaction. No public proof-of-concept exploit has been identified at time of analysis.