Insecure Deserialization in Ray Serve Leading to Remote Code Execution
Overview
A critical remote code execution (RCE) vulnerability was found in Ray, a popular open-source framework for scaling AI and Python applications. The vulnerability, assigned CVE-2025-6012, resided in the Ray Serve component, which is used for deploying and serving machine learning models. The issue was due to the unsafe use of Python's `pickle` library for deserializing user-provided data in certain API endpoints. An unauthenticated remote attacker could send a specially crafted HTTP request containing a malicious pickle payload to a publicly exposed Ray Serve endpoint. Upon receipt, the server would deserialize the payload without proper validation, leading to the execution of arbitrary Python code with the privileges of the Ray service account. This could allow an attacker to take full control of the Ray cluster, steal sensitive data and models, deploy malicious models, or use the compromised cluster for further attacks within the network. The vulnerability was particularly severe because Ray clusters are often provisioned with significant computational resources (including GPUs) and access to sensitive datasets. The Anyscale team, maintainers of Ray, promptly released a patch that replaced the insecure deserialization mechanism with a safer, JSON-based serialization format for the affected endpoints.
Affected Systems
Testing Guide
1. Check your installed Ray version by running `pip show ray` or `ray --version`. 2. If the version is between 2.0.0 and 2.7.0 inclusive, your deployment is vulnerable. 3. Review your network security group and firewall rules to determine if your Ray Serve port (default 8000) is exposed to untrusted networks (e.g., 0.0.0.0/0).
Mitigation Steps
1. Upgrade Ray to version 2.7.1 or a later version immediately. 2. Never expose a Ray head node or Ray Serve endpoints directly to the public internet. Place them behind a properly configured firewall, reverse proxy, or API gateway that can filter malicious requests. 3. Implement network policies to restrict access to the Ray cluster ports (e.g., 8265 for the dashboard, 8000 for Serve) to trusted IP ranges. 4. Run the Ray cluster with a dedicated, least-privilege service account to limit the blast radius in case of a compromise.
Patch Details
The vulnerability is patched in Ray version 2.7.1 and all subsequent releases.