CVE-2025-34351: Ray's New Token Authentication is Disabled By Default
(updated )
Anyscale Ray 2.52.0 contains an insecure default configuration in which token-based authentication for Ray management interfaces (including the dashboard and Jobs API) is disabled unless explicitly enabled by setting RAY_AUTH_MODE=token. In the default unauthenticated state, a remote attacker with network access to these interfaces can submit jobs and execute arbitrary code on the Ray cluster. NOTE: The vendor plans to enable token authentication by default in a future release. They recommend enabling token authentication to protect your cluster from unauthorized access.
References
- docs.ray.io/en/latest/ray-security/token-auth.html
- github.com/JLLeitschuh/security-research/security/advisories/GHSA-w8vc-465m-jjw6
- github.com/advisories/GHSA-gx77-xgc2-4888
- github.com/ray-project/ray
- github.com/ray-project/ray/releases/tag/ray-2.52.0
- nvd.nist.gov/vuln/detail/CVE-2025-34351
- www.cve.org/resourcessupport/allresources/cnarules
- www.linkedin.com/posts/jonathan-leitschuh_the-latest-piece-of-mind-bending-research-activity-7396976425997606912-qizE
- www.oligo.security/blog/shadowray-2-0-attackers-turn-ai-against-itself-in-global-campaign-that-hijacks-ai-into-self-propagating-botnet
- www.oligo.security/blog/shadowray-attack-ai-workloads-actively-exploited-in-the-wild
- www.vulncheck.com/advisories/anyscale-ray-token-authentication-disabled-by-default-insecure-configuration
Code Behaviors & Features
Detect and mitigate CVE-2025-34351 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →