ShadowRay 2.0 turns your Ray cluster into a botnet. CVE-2023-48022 is the Ray framework flaw behind it, and Oligo Security showed it live at Black Hat this week. I read through what Gal Elbaz and Avi Lumelsky put out, and the part that should scare you is not the exploit. It's that this is "disputed." The CVE is marked as won't-fix. The Ray Jobs API has no auth by default. That's not a bug to them, it's the design. So there's no patch coming. You are the patch. Here's the chain: Ray exposes a dashboard/Jobs API with no authentication. Anyone who reaches it can submit a job. A job is arbitrary code on your box. That's remote code execution (RCE), full stop. ShadowRay 2.0 weaponizes that into a worm: infected node scans for the next open cluster, submits itself, repeats. The numbers: 200,000+ exposed servers. Campaign running since September 2024. So this has been quietly eating clusters for almost a year. Why builders get burned: Ray is the thing under your training and inference jobs. It sits on the fattest hardware you own, with cloud creds and model weights right there. You did not "deploy a public service," you spun up a cluster for an internal job and assumed the network was private. It wasn't. Running Ray to serve a fraud-detection model for a payments company? Picture that dashboard reachable from the office VPN, or worse, a misconfigured security group. One submitted job and the attacker has your GPUs mining, your weights exfiltrating, and a foothold that scans for your other clusters. Building on Ray? BEFORE (dangerous): // ray up cluster.yaml with defaults // dashboard on 0.0.0.0:8265, no auth // security group open to 0.0.0.0/0 "just for testing" AFTER (safe): // bind dashboard to 127.0.0.1 or a private subnet only // put Ray behind an auth proxy (mTLS / OAuth), never raw // lock the security group to known IPs, deny public ingress // run workers as a low-priv user, not root, with scoped cloud creds // alert on any job submission you did not trigger The fix is not a vendor patch. It's you treating the Jobs API as remote code execution exposed to whoever can route to it, because that is exactly what it is. Go check right now: is your Ray dashboard reachable from outside your VPN? Do you even know which of your clusters are running Ray today? #AISecurity #CVE202348022 #RayFramework
Post summary
The post warns that CVE‑2023‑48022 has a PoC, is actively exploited in a worldwide botnet campaign, and no patch is forthcoming – requiring immediate mitigations.
