Detections
Analytics
SCA: security update for ray (GHSA-q5fh-2hc8-f6rq)
medium Tenable Cloud Security Plugin ID 437917
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Ray is an AI compute engine. In versions 2.53.0 and below, thedashboard HTTP server blocks browser-origin
POST/PUT but does not cover DELETE, and key DELETE endpoints are unauthenticated by default. If the
dashboard/agent is reachable (e.g., --dashboard-host=0.0.0.0), a web page via DNS rebinding or same-
network access can issue DELETE requests that shut down Serve or delete jobs without user interaction.
This is a drive-by availability impact. The fix for this vulnerability is to update to Ray 2.54.0 or
higher. (CVE-2026-27482)
See Also
Plugin Details
Severity: Medium
ID: 437917
Version: Revision 1.9
Type: Local
Family: SCA Checks
Published: 2/21/2026
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 3.5
Percentile: 52.04
Vendor
Vendor Severity: Medium
CVSS v2
Risk Factor: Medium
Base Score: 6.1
Temporal Score: 4.8
Vector: CVSS2#AV:N/AC:H/Au:N/C:N/I:P/A:C
CVSS Score Source: CVE-2026-27482
CVSS v3
Risk Factor: Medium
Base Score: 6.5
Temporal Score: 5.9
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 2/20/2026
Vulnerability Publication Date: 2/20/2026
Reference Information
CVE: CVE-2026-27482