Ray Project - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/ray-project/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 11 Aug 2026 14:06:04 +0000Directory Traversal and LFI in Ray 2.56.0https://feed.craftedsignal.io/briefs/2026-08-ray-traversal/Tue, 11 Aug 2026 14:06:04 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-ray-traversal/Ray 2.56.0 contains a directory traversal and local file inclusion vulnerability in the /api/v0/logs endpoint allowing unauthenticated attackers to read arbitrary files.Ray version 2.56.0 contains a critical directory traversal and local file inclusion vulnerability within the /api/v0/logs API endpoint. The vulnerability allows an unauthenticated remote attacker to access files outside the intended log directory by supplying a crafted glob filter via the 'glob' parameter. An attacker must possess a valid node_id to interact with the API successfully. This vulnerability has been documented with a functional proof-of-concept exploit which demonstrates the ability to read sensitive files from the underlying host filesystem, such as those within /etc. Ray maintainers have been notified, and a fix is currently under review in GitHub Pull Request 64701.

Attack Chain

  1. Attacker performs reconnaissance to identify Ray dashboard instances accessible over the network, typically on port 6379.
  2. Attacker probes the environment to enumerate or discover a valid node_id required for interaction with the /api/v0/logs endpoint.
  3. Attacker crafts an HTTP GET request to the /api/v0/logs endpoint.
  4. Attacker includes the 'node_id' parameter with the discovered identifier.
  5. Attacker injects a malicious traversal payload into the 'glob' parameter, such as '../../../../etc/*'.
  6. The Ray API processes the glob pattern without sufficient validation, concatenating the malicious path.
  7. The application returns the contents of the requested file or directory within the HTTP response body.
  8. Attacker successfully exfiltrates sensitive files from the server's filesystem.

Impact

Successful exploitation allows unauthenticated remote attackers to read arbitrary files on the system running Ray, potentially leading to the exposure of credentials, configuration files, or other sensitive system data. The vulnerability is confirmed to affect Ubuntu 22.04 and RHEL 10.0 deployments.

Recommendation

  • Implement network access controls to restrict access to the Ray dashboard (default port 6379) to authorized internal networks only.
  • Monitor webserver logs for HTTP GET requests to '/api/v0/logs' containing directory traversal characters (e.g., '../') in the 'glob' parameter.
  • Deploy the Sigma rule provided in this brief to identify exploitation attempts against the logs API.
  • Apply the vendor-provided patch once released via the official Ray project repository (GH PR 64701).
]]>highadvisorywebappsdirectory-traversallfi