Status: Patched
This vulnerability has been verified as resolved and deployed.
Unauthenticated Serve replica gRPC requests allow arbitrary code execution
Summary
Every Python Serve replica exposed an unauthenticated pickle sink on an ephemeral node port
A network caller could invoke an internal Serve replica gRPC method without the configured Ray token and place a Python pickle reduction in pickled_request_metadata, causing arbitrary code execution in the replica process before normal request dispatch.
Root cause. Replica.__init__ created ASGIService with raw grpc.aio.server() and _on_initialized bound it through add_insecure_port("[::]:0"). The shared token interceptor and TLS helper were skipped, while _wrap_grpc_call performed pickle.loads() as its first operation.
Remediation evidence. Ray opened exact PR #65189 after the disclosure and merged it on 5 August 2026. The patch moves both server and client sides to Ray's shared authenticated/TLS-aware gRPC helpers and adds token-mode coverage.
CVSS Score
Vulnerability Location
Source-to-Sink Analysis
Each initialized Python Serve replica created a raw asynchronous gRPC server outside Ray's authentication factory.
The internal service was exposed on an all-interface ephemeral port without TLS or token interception.
Any registered ASGI RPC reached an unconditional deserialization sink before admission control or user-code dispatch.
Impact Analysis
Critical Impact
The attacker obtains arbitrary Python/process execution in an existing Serve replica despite token authentication. That process authority can expose inherited secrets, files, cloud identity, application state, and network access, and can tamper with or terminate the service.
Attack Surface
Ephemeral ray.serve.ASGIService gRPC ports reachable on Ray cluster or VPN node networks when a Python Serve replica is initialized.
Preconditions
The attacker needs TCP reachability to a Ray node and the replica's discoverable ephemeral port. The documented token mode may be enabled; no valid token, deployment handle, or victim interaction is required.
Proof of Concept
Environment Setup
Use an isolated Ray cluster on the vulnerable revision with RAY_AUTH_MODE=token and deploy one harmless Python Serve replica.
Target Configuration
Allow the test client to reach node ephemeral ports, but do not provide it the Ray authentication token.
Exploit Delivery
Discover the ASGIService port and send one protobuf request whose pickled_request_metadata contains a harmless proof reduction, such as writing a marker in the disposable container.
Outcome
PR #65189 attaches Ray's asynchronous authentication interceptor and uses the corresponding client/channel helper, so the same unauthenticated request is rejected before deserialization.
Expected Response: The marker appears in the replica before request metadata validation; missing or invalid authorization metadata does not block the RPC.
Run this level of analysis on your repo.
Winfunc traces source-to-sink paths, validates exploitability, and gives your team patch-ready remediation.