ShadowRay (CVE-2023-48022) — Ray Job-Submission RCE Postmortem

The job-submission API accepts and executes arbitrary Python with no authentication; any network-reachable client can run code on cluster nodes. Remote code execution, cryptojacking, data and credential theft, and lateral movement; 200,000+ exposed servers observed, later weaponised into a botnet. You are likely affected if you run Ray job-submission API / Ray Dashboard (no authentication by default). at the versions noted in the record below. We can audit your cluster against this and the wider class of AI-infrastructure risks and tell you precisely where you are exposed.

Fix: There is no auth-adding patch (the vendor considers isolation the control); treat hardening as the fix — isolate, authenticate at the proxy/ingress, and monitor for unexpected job submissions. Mitigation if you cannot patch immediately: Never expose the Ray dashboard/API to untrusted networks. Enforce network isolation (private subnets, NetworkPolicy), put an authenticating reverse proxy in front, bind to localhost/cluster-internal only, and lock down the KubeRay service type (no public LoadBalancer). We help you apply the fix safely in production — staged rollout, verification, and the admission/network guardrails that reduce blast radius for the next issue of this class.

"Runs only in a trusted network" is an operational requirement you must enforce. For AI frameworks that assume a trusted perimeter, network isolation and an auth layer are not optional. This is why we treat the AI-infrastructure supply chain, container runtime, and admission path as security-critical — not just the application layer.

Yes. We run a focused review of your container runtime (NVIDIA Container Toolkit / GPU Operator versions), ingress and admission webhooks, model and image supply chain, agent/tool sandboxing, and RBAC/network policy — mapping each finding to a concrete fix and a guardrail. See our Kubernetes AI security hub.

Both. This page documents a real, publicly disclosed incident with its official source so you can act on it. If you would rather an engineer work it with you — patching safely in production, or auditing for the wider class of risk — that service is available same-day and confidentially.