{"id":"CVE-2023-48022","published":"2023-11-28T00:00:00Z","modified":"2025-12-17T16:41:47Z","title":"Anyscale Ray 2.6.3 and 2.8.0 allows a remote attacker to execute arbitrary code via the job submission API","vendor":null,"product":null,"tier":"core","eol":null,"description":{"text":"Anyscale Ray 2.6.3 and 2.8.0 allows a remote attacker to execute arbitrary code via the job submission API. NOTE: the vendor's position is that this report is irrelevant because Ray, as stated in its documentation, is not intended for use outside of a strictly controlled network environment. (Also, within that environment, customers at version 2.52.0 and later can choose to use token authentication.)","provenance":"source","from":"CVE.org"},"summary":{"text":"Anyscale Ray versions 2.6.3 and 2.8.0 contain a flaw in the job submission API that allows arbitrary code execution. A remote attacker with network access can exploit it without authentication or user interaction, though the vendor states Ray is not intended for use outside a strictly controlled network and notes that token authentication is available from version 2.52.0 onward.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T13:44:22Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.83942,"percentile":0.99692,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2024-03-26","exploitedFirstSeen":"2024-03-26","ransomware":false,"evidence":[{"url":"https://www.oligo.security/blog/shadowray-attack-ai-workloads-actively-exploited-in-the-wild","date":"2024-03-26"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-04-05&host_type=src&vulnerability=cve-2023-48022","date":"2024-04-05"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-04-06&host_type=src&vulnerability=cve-2023-48022","date":"2024-04-06"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-04-07&host_type=src&vulnerability=cve-2023-48022","date":"2024-04-07"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-04-08&host_type=src&vulnerability=cve-2023-48022","date":"2024-04-08"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-04-09&host_type=src&vulnerability=cve-2023-48022","date":"2024-04-09"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-04-10&host_type=src&vulnerability=cve-2023-48022","date":"2024-04-10"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-04-11&host_type=src&vulnerability=cve-2023-48022","date":"2024-04-11"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-04-12&host_type=src&vulnerability=cve-2023-48022","date":"2024-04-12"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-04-13&host_type=src&vulnerability=cve-2023-48022","date":"2024-04-13"}],"evidenceTotal":160,"provenance":"source"},"exploited":true,"otx":{"pulseCount":15,"pulses":[{"name":"N4D Mesh Controller: New infrastructure, a UPX-packed agent labeled \"go-titan,\" and how to hunt for it","url":"https://otx.alienvault.com/pulse/6a87f29d5dfdc80aeece5470","created":"2026-08-21"},{"name":"N4D Mesh Controller: New infrastructure, a UPX-packed agent labeled \"go-titan,\" and how to hunt for it","url":"https://otx.alienvault.com/pulse/6a873496e3b94c2a2c962d39","created":"2026-08-20"},{"name":"EbeeAug2026 Pt5","url":"https://otx.alienvault.com/pulse/6a863d7d5acc49157b7f7f84","created":"2026-08-19"},{"name":"*Dormant Destruction*                           VirusTotal report                    for index.html","url":"https://otx.alienvault.com/pulse/6a0050a164795207832b4331","created":"2026-05-10"},{"name":"Spam “Broken Seal” DocuSign-themed Delivery w/Fileless Process Hollowing (Zeppelin/Bloat-A) by msudosos","url":"https://otx.alienvault.com/pulse/69bf64eccb5d39a90a3c391e","created":"2026-03-22"},{"name":"Spam “Broken Seal” DocuSign-themed Delivery w/Fileless Process Hollowing (Zeppelin/Bloat-A) by msudosos","url":"https://otx.alienvault.com/pulse/69bf64e1d5e06aa6207f78de","created":"2026-03-22"},{"name":"CVE Data","url":"https://otx.alienvault.com/pulse/69929b597293fe5837b9c95c","created":"2026-02-16"},{"name":"“Broken Seal” DocuSign-themed Delivery with Fileless Process Hollowing (Zeppelin/Bloat-A)","url":"https://otx.alienvault.com/pulse/698e93e1ab02db8c49e8c3ed","created":"2026-02-13"},{"name":"Double Umbrella AS15169/AS21928: This evaluates a critical structural convergence between Google (AS15169) and T-Mobile USA (AS21928) within the global Tier-1 routing backbone","url":"https://otx.alienvault.com/pulse/698d30c03b57c38dff915023","created":"2026-02-12"},{"name":"ShadowRay 2.0: Active Global Campaign Hijacks Ray AI Infrastructure Into Self-Propagating Botnet","url":"https://otx.alienvault.com/pulse/691d46b4135d2acc04876592","created":"2025-11-19"}],"provenance":"machine"},"cwes":[{"id":"CWE-918","name":"Server-Side Request Forgery"}],"references":[{"url":"https://bishopfox.com/blog/ray-versions-2-6-3-2-8-0","tags":[]},{"url":"https://docs.ray.io/en/latest/ray-security/index.html","tags":[]},{"url":"https://www.vicarius.io/vsociety/posts/shadowray-cve-2023-48022-exploit","tags":[]},{"url":"https://atlas.mitre.org/studies/AML.CS0023","tags":[]},{"url":"https://docs.ray.io/en/latest/ray-security/token-auth.html","tags":[]},{"url":"https://www.vicarius.io/vsociety/posts/the-story-of-shadowray-cve-2023-48022","tags":[]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: remote exploitation of public-facing job submission API","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"allows a remote attacker to execute arbitrary code via the job submission API","start":29,"end":106}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: arbitrary code execution on the host","mappingType":"primary_impact","evidence":[{"from":"description","quote":"allows a remote attacker to execute arbitrary code","start":29,"end":79}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-21b639fa149328c86d0e","title":"ShadowRay: First Known Attack Campaign Targeting AI Workloads Exploited In The Wild","publisher":"oligo.security","url":"https://www.oligo.security/blog/shadowray-attack-ai-workloads-actively-exploited-in-the-wild","date":null,"mentions":[{"quote":"While four of the reported vulnerabilities were fixed in Ray version 2.8.1, the fifth CVE (CVE-2023-48022) remains disputed, meaning that it was not considered a risk and was not addressed with an immediate fix.","start":1345,"end":1556},{"quote":"Because CVE-2023-48022 was disputed, many development teams (and most static scanning tools) are not aware that this vulnerability should concern them.","start":1560,"end":1711},{"quote":"Researchers at Oligo Security have observed instances of CVE-2023-48022 being actively exploited in the wild, making the disputed CVE a “shadow vulnerability”—a CVE that doesn’t show up in static scans but can still lead to breaches and significant losses.","start":1829,"end":2085},{"quote":"The Story of CVE-2023-48022: ShadowRay Explained","start":3554,"end":3602},{"quote":"The story of CVE-2023-48022: ShadowRay Explained","start":7065,"end":7113}]}],"affected":[{"ecosystem":"PyPI","package":"ray","vulnerableRanges":["<=2.49.2"],"patched":[],"from":["GHSA-6wgj-66m2-xxp2","PYSEC-2026-517"],"provenance":"source"}],"advisories":[{"id":"GHSA-6wgj-66m2-xxp2","url":"https://github.com/advisories/GHSA-6wgj-66m2-xxp2","severity":"CRITICAL","ecosystem":"PyPI","package":"ray","vulnerableRanges":["<=2.49.2"],"patched":[],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2023-52111","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-52111","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":2,"skipped":1,"earliest":"2024-01-10","earliestUrl":"https://github.com/0x656565/CVE-2023-48022","repos":[{"name":"jakabakos/ShadowRay-RCE-PoC-CVE-2023-48022","url":"https://github.com/jakabakos/ShadowRay-RCE-PoC-CVE-2023-48022","stars":7,"created":"2024-03-29"},{"name":"0x656565/CVE-2023-48022","url":"https://github.com/0x656565/CVE-2023-48022","stars":2,"created":"2024-01-10"}]},"metasploit":[{"name":"Ray Agent Job RCE","module":"exploit/linux/http/ray_agent_job_rce","type":"exploit","disclosureDate":"2023-11-15","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/ray_agent_job_rce.rb"}],"nuclei":[{"id":"CVE-2023-48022","name":"Anyscale Ray - Remote Code Execution","severity":"critical","path":"http/cves/2023/CVE-2023-48022.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-48022.yaml"}],"first":{"date":"2023-11-15","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/ray_agent_job_rce.rb"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2023-11-15","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2024-01-10","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/ray_agent_job_rce.rb","provenance":"source"},{"date":"2023-11-28","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2023-48022","provenance":"source"},{"date":"2024-03-26","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.oligo.security/blog/shadowray-attack-ai-workloads-actively-exploited-in-the-wild","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":73.4,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 949 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.94,"detail":"percentile 0.9969"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"2 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":2.73,"detail":"15 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}