ray has 9 CVEs on record between 2023 and 2026. The median CVSS is 9.3 (critical), with 6 rated critical. 11% have been exploited in the wild, in line with the corpus average.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 11% vs 1% corpus
- Median CVSS
- 9.3
- Publish → KEV
- —(1)
- Last 90 days
- 0 prev 1
Worst active — by depth score
CVE-2023-48022Critical· 9.8Ray has arbitrary code execution via jobs submission API83CVE-2025-62593CriticalRay is an AI compute engine81CVE-2023-6019Critical· 9.8Ray OS Command Injection vulnerability81CVE-2023-6021Critical· 9.3Ray Path Traversal vulnerability71CVE-2023-6020Critical· 9.3Ray Missing Authorization vulnerability66
ray vulnerabilities
CVEs affecting ray, newest first. Open any entry for full detail, references, and exploit status.
9 CVEsRSS
CVE-2026-41486HighRay: Remote Code Execution via Parquet Arrow Extension Type Deserialization
Ray: Remote Code Execution via Parquet Arrow Extension Type Deserialization
CVE-2026-27482Medium· 5.9Ray dashboard DELETE endpoints allow unauthenticated browser-triggered DoS (Serve shutdown / job deletion)
Ray dashboard DELETE endpoints allow unauthenticated browser-triggered DoS (Serve shutdown / job deletion)
CVE-2025-34351CriticalRay's New Token Authentication is Disabled By Default
Ray's New Token Authentication is Disabled By Default
CVE-2025-62593CriticalCISA KEVPoCRay is an AI compute engine
Ray is an AI compute engine. Prior to version 2.52.0, developers working with Ray as a development tool can be exploited via a critical RCE vulnerability exploitable via Firefox and Safari. This vulnerability is due to an insufficient gu…
CVE-2025-1979Medium· 6.4ray vulnerable to Insertion of Sensitive Information into Log File
ray vulnerable to Insertion of Sensitive Information into Log File
CVE-2023-48022Critical· 9.8PoCRay has arbitrary code execution via jobs submission API
Ray has arbitrary code execution via jobs submission API
CVE-2023-6019Critical· 9.8PoCRay OS Command Injection vulnerability
Ray OS Command Injection vulnerability
CVE-2023-6020Critical· 9.3PoCRay Missing Authorization vulnerability
Ray Missing Authorization vulnerability
CVE-2023-6021Critical· 9.3PoCRay Path Traversal vulnerability
Ray Path Traversal vulnerability