Ray < 2.43.0 leaks Redis password in logs
Date: 2025-03
Affected: ray < 2.43.0
Attack vector: info-disclosure
Category: real-world
Severity: Medium
CVE: CVE-2025-1979
CWE: CWE-532
CVSS: 6.5 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N)

Versions of Ray before 2.43.0 are vulnerable to Insertion of Sensitive Information into Log File: the Redis password (when passed as an argument) is logged in standard logs, allowing credential disclosure where logs are accessible.


Mitigations:

Architectural layers (MAESTRO):