18.4万个Ray AI仪表板在线暴露，无需身份验证
在深入研究一个已知的Ray Dashboard漏洞时，我发现了一个令人担忧的情况——超过184,000个Ray仪表板在没有任何登录或访问控制的情况下公开可用。这些仪表板允许任何人远程运行代码、窃取机密或劫持AI基础设施。
我详细说明了这种暴露的情况、攻击者可能如何利用它，以及团队可以采取哪些措施来保护他们的设置。这不仅仅是配置错误——这是在AI基础设施部署方面的系统性疏忽。
我很想听听你的想法，或者看看是否还有其他人发现了类似的案例。
查看原文
https://medium.com/@hacker_might/no-auth-no-problem-how-184-000-exposed-ray-dashboards-are-putting-ai-infrastructure-at-risk-fe737116afa8<p>While digging into a known Ray Dashboard vulnerability, I discovered something alarming—over 184,000 Ray dashboards are publicly accessible without any login or access control. These dashboards allow anyone to remotely run code, steal secrets, or hijack AI infrastructure.<p>I detail the exposure, how attackers could abuse it, and what teams can do to secure their setups. This goes far beyond misconfiguration—it’s a systemic oversight in how AI infra is deployed.<p>Would love to hear your thoughts or see if others have found similar cases.