CVE-2026-27482
Anyscale Ray ≤ 2.54.0
Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:HSummary
CVE-2026-27482 is a medium-severity Declaration of Catch for Generic Exception (CWE-396) vulnerability in Anyscale Ray. Its CVSS base score is 5.9 (Medium).
Operationally, ranked at the 17th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
This vulnerability is AI-related — categorised as Other Platforms; in the Supply Chain and Deployment risk domain.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-7716
Vulnerability Data
Ray is an AI compute engine. In versions 2.53.0 and below, thedashboard HTTP server blocks browser-origin POST/PUT but does not cover DELETE, and key DELETE endpoints are unauthenticated by default. If the dashboard/agent is reachable (e.g., --dashboard-host=0.0.0.0), a web page…
more
via DNS rebinding or same-network access can issue DELETE requests that shut down Serve or delete jobs without user interaction. This is a drive-by availability impact. The fix for this vulnerability is to update to Ray 2.54.0 or higher.
- CWE(s)
AI Security AnalysisAI
- AI Category
- Other Platforms
- Risk Domain
- Supply Chain and Deployment
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Matched keywords: ai
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V16.5.1
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation (including static analysis and code review) directly finds declarations of overly generic catch blocks.
Requiring documented development standards and tools can mandate specific exception-handling rules that prohibit generic catches.
Security engineering principles include explicit requirements for precise, least-privilege exception handling rather than broad catches.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly enforce specific exception handling as part of coding standards, though the control addresses the full development lifecycle beyond this single weakness.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect generic catch blocks, but does not guarantee their removal.
Secure SDLC processes encourage disciplined exception handling, yet the control itself does not mandate specific coding rules.
Secure coding standards explicitly prohibit overly broad exception handlers that mask errors and create exploitable paths.