This research analyzed the runtime network surface of distributed LLM serving using KubeRay and vLLM pipeline parallelism on an Amazon EKS 1.35 cluster. It discovered that 15 of 17 Ray listening sockets were omitted from pod containerPort metadata, enabling an unprivileged pod in an unrelated namespace to reach Ray GCS (port 6379) and raylet RPC ports (10002-10006) over unauthenticated cleartext gRPC. Four default Kubernetes security scanners failed to detect this exposure because they did not inspect the RayCluster custom resource. A default-deny NetworkPolicy effectively blocked these ports from neighbor pods in steady state. WireGuard encryption chained with AWS VPC CNI introduced a 3.4% to 6.5% throughput drop. The Ray Job API (port 8265) accepted unauthenticated requests on default CPU Ray images but was not listening in GPU vLLM deployments. The study's disclosures clarify that these behaviors are documented vendor defaults, not new vulnerabilities, and that a previously known vLLM API key bypass (CVE-2026-48746) has been fixed upstream.

The study highlights that default vendor configurations for Ray control-plane components in Kubernetes clusters can expose unauthenticated gRPC services to unprivileged pods in unrelated namespaces. This exposure could allow unauthorized access to Ray control-plane services, potentially impacting confidentiality and integrity of distributed LLM inference operations. However, the presence of default-deny NetworkPolicies mitigates this exposure in steady state. The Ray Job API's acceptance of unauthenticated requests on CPU Ray images represents an additional risk vector, though no remote code execution was demonstrated in GPU deployments. The findings do not represent new vulnerabilities but rather documented default behaviors, with a related vLLM API key bypass already fixed upstream.

The default-deny NetworkPolicy effectively blocks unauthorized access to Ray control-plane ports and should be maintained or implemented if absent. Vendors and operators should ensure that RayCluster custom resources are properly inspected by security scanners, as default tools may not detect this exposure. Enabling WireGuard encryption chained with AWS VPC CNI can provide additional network-layer protection with minimal throughput impact. Operators should update to patched versions of vLLM to address the previously known API key bypass (CVE-2026-48746). No new patches are indicated for the observed default behaviors, but hardening network policies and authentication configurations is recommended.