Ray Fixed a Serve Port That Skipped Token Auth, No CVE

Ray 2.58.0 went out at 05:42 UTC on 23 August. Among the entries in Ray Serve's fixes section is a single line: fix the Serve replica ASGIService bypassing token authentication. No security advisory is attached, no CVE was requested, and no severity is given.

What the pull request says

PR #65189 is considerably more explicit than the changelog. The internal gRPC server in Serve replicas “was built with a raw grpc.aio.server() and bound with add_insecure_port”, making it, in the author's words, the only Python-side gRPC server in Ray that skipped both of Ray's transport controls. Under RAY_AUTH_MODE=token the service accepted requests lacking valid credentials and reached pickle.loads(request.pickled_request_metadata) before performing any validation. Under RAY_USE_TLS=1, where Ray's other Python gRPC servers use mTLS, this port stayed unencrypted.

Reaching pickle.loads before validation is the whole problem

Deserialising an attacker-supplied pickle is arbitrary code execution by design — Python's own documentation says as much. The ordering is what matters here: the untrusted payload was unpickled first and authenticated second, which makes the authentication irrelevant on that path rather than merely weak.

The distortion: not a new hole, a five-release gap

Ray introduced token authentication described as covering all Ray components in 2.52.0. This port was not covered by it. Anyone who enabled RAY_AUTH_MODE=token on the strength of that release note has been running an unauthenticated deserialisation endpoint on every Serve replica since. The fix does not add protection; it closes the distance between what was documented and what was true.

The fix predates the release by eighteen days

PR #65189 merged on 5 August. It reached operators on 23 August, when 2.58.0 shipped. For those eighteen days the patch sat readable in a public repository while no release carried it — the standard cost of fixing a security issue in the open without an embargo, and the reason the changelog line matters more than its placement suggests.

What operators should check

Exposure depends on network reach, since the port binds across interfaces on an ephemeral port. The clusters that matter are those where Serve replicas sit on a network reachable by untrusted callers. Upgrading moves both client and server onto Ray's shared gRPC helpers, which apply the interceptors and TLS settings the rest of Ray already used.