Anyscale Ray insufficient authentication (related to ShadowRay)
Date: 2023-11
Affected: ray (default config)
Attack vector: auth-bypass
Category: real-world
Severity: High
CVE: CVE-2023-48023
CVSS: 7.5 ()

Anyscale Ray missing/insufficient authentication enabling lateral abuse of cluster components. Companion to CVE-2023-48022.


Mitigations:

Architectural layers (MAESTRO):