Ray 2.56.0 – Unauthenticated Directory Traversal & Local File Inclusion in the /logs API
What Happened — A proof‑of‑concept exploit published on Exploit‑DB (EDB‑ID 52635) shows that Ray 2.56.0’s /api/v0/logs endpoint accepts a crafted glob pattern, allowing an unauthenticated attacker to read arbitrary files outside the log directory (e.g., /etc/passwd). The issue affects Ray installations on Ubuntu 22.04 and RHEL 10.0 and is pending CVE assignment.
Why It Matters for Compliance & Audit Readiness
- The flaw exemplifies a control gap that SOC 2 Security and Availability criteria require you to detect, remediate, and evidence continuously.
- Mapping this vulnerability to your control inventory and capturing remediation evidence satisfies the “monitoring of security controls” and “risk mitigation” requirements.
- Verisq’s Control Mapping capability automates the linkage between discovered flaws and the specific SOC 2 controls they impact, providing audit‑ready proof that the issue was identified, prioritized, and closed.
Who Is Affected – Cloud‑infrastructure providers, AI/ML platform operators, and any organization that runs Ray for distributed workloads (technology/SaaS, cloud‑infra).
Recommended Actions
- Immediately apply the upstream fix once the Ray maintainers merge the pending pull request.
- Add the
/api/v0/logsendpoint to your API‑gateway allow‑list and enforce authentication/authorization checks. - Map the vulnerability to SOC 2 CC6.1 (Logical Access Controls) and CC7.1 (System Operations) in your control library; capture remediation tickets and patch‑deployment logs as evidence.
Technical Notes – The exploit sends a GET request to http://<target>:6379/api/v0/logs?node_id=<id>&glob=../../../../etc/. No authentication is required, making it a classic unauthenticated LFI. The issue is tracked in GitHub Issue #45751 and Pull Request #64701. Source: https://www.exploit-db.com/exploits/52635*