ExploitPublished 19 Nov 2025

Two-Year-Old Ray AI Framework Flaw Exploited in Ongoing Campaign

Source SecurityWeek

Severity

Medium

Rated by Threat Radar

Data as of 20 Nov 2025, 13:23 UTC

What to do

AI-suggested

1. Immediate action should focus on identifying all Ray cluster deployments within the organization, including cloud and on-premises instances. 2. Apply any available patches or updates from Anyscale as soon as they are released; if no patches exist, consider temporary workarounds such as disabling exposed management interfaces. 3. Enforce strict network segmentation and isolation for Ray clusters, ensuring that only trusted internal systems can communicate with cluster nodes and management endpoints. 4. Implement robust authentication and authorization controls on Ray cluster access points to prevent unauthorized use. 5. Monitor cluster logs and network traffic for unusual activity indicative of exploitation attempts, such as unexpected task submissions or remote code execution patterns. 6. Conduct regular security audits and configuration reviews of Ray deployments to identify and remediate misconfigurations. 7. Educate development and operations teams about the risks associated with Ray cluster exposure and best practices for secure deployment. 8. Consider deploying runtime application self-protection (RASP) or endpoint detection and response (EDR) solutions on cluster nodes to detect and block malicious activity. 9. Limit the use of Ray clusters to trusted environments and avoid exposing them directly to the internet without proper safeguards. 10. Establish incident response plans specific to AI/ML infrastructure compromises to enable rapid containment and recovery.

Description

Threat actors are abusing Ray’s lack of authentication to compromise exposed clusters and deploy LLM-generated payloads and cryptocurrency miners. The post Two-Year-Old Ray AI Framework Flaw Exploited in Ongoing Campaign appeared first on SecurityWeek .

Impact

For European organizations, the exploitation of this Ray framework vulnerability can have several impacts. Confidentiality may be compromised if attackers gain access to sensitive AI/ML model data or proprietary datasets processed within Ray clusters. Integrity is at risk as attackers could manipulate AI workloads or inject malicious code, potentially corrupting model training or inference results. Availability could be affected if attackers disrupt cluster operations or deploy ransomware or other destructive payloads. Organizations heavily reliant on AI/ML for critical business functions, research, or services could face operational disruptions and reputational damage. The risk is heightened in sectors such as finance, healthcare, and manufacturing, where AI workloads are increasingly integral. Additionally, cloud deployments common in Europe may expose clusters if network segmentation and access controls are insufficient. The ongoing exploitation campaign suggests that threat actors are actively targeting these environments, increasing the urgency for mitigation. Failure to address this vulnerability could lead to unauthorized access, data breaches, and broader network compromise within European enterprises.

Summary

The Ray AI framework, maintained by Anyscale, is an open-source platform designed to scale Python-based artificial intelligence and machine learning applications by distributing workloads across clusters, often deployed in cloud environments. A vulnerability discovered two years ago in Ray has recently been exploited in an ongoing campaign targeting multiple Ray clusters. This flaw enables remote code execution (RCE), allowing attackers to run arbitrary commands or code on compromised nodes within the cluster. The exploitation of this vulnerability can lead to full system compromise, data exfiltration, or lateral movement within the victim's infrastructure. The attack surface is significant because Ray clusters are commonly deployed in cloud or hybrid environments where misconfigurations or insufficient isolation can expose management interfaces or worker nodes to the internet or untrusted networks. Although the specific technical details and affected versions are not provided, the nature of the vulnerability suggests that it leverages weaknesses in Ray's cluster communication or task scheduling mechanisms. The ongoing campaign indicates active exploitation, emphasizing the need for immediate attention by organizations using Ray. No official patches or CVSS scores are mentioned, but the medium severity rating reflects a balance between the potential impact and the complexity of exploitation, which may require some level of access or misconfiguration to succeed.

References

securityweek.com/two-year-old-ray-ai-framework-flaw-exploited-in-ongoing-campaign/ (opens in a new tab)

Community reviews

Loading reviews…

What to do

Description

AI analysisMachine-generated, updated 19 Nov 2025, 13:36 UTC

References

Community reviews