Sensitive information in log files in ray
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 1 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-532.
Summary
Versions of the package ray before 2.43.0 are vulnerable to Insertion of Sensitive Information into Log File where the redis password is being logged in the standard logging. If the redis password is passed as an argument, it will be logged and could potentially leak the password. This is only exploitable if: 1) Logging is enabled; 2) Redis is using password authentication; 3) Those logs are accessible to an attacker, who can reach that redis instance. **Note:** It is recommended that anyone who is running in this configuration should update to the latest version of Ray, then rotate their redis password.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | ray | before 2.43.0 | 2.43.0 | Patch available | CNA |
| — | ray (PyPI) | before 2.43.0 | 2.43.0 | Patch available | GHSA-w4rh-fgx7-q63m |
- ray Vendor— Affected before 2.43.0 Fixed in 2.43.0 Patch available CNA
- ray (PyPI) Vendor— Affected before 2.43.0 Fixed in 2.43.0 Patch available GHSA-w4rh-fgx7-q63m
Remediation
- Fix · CNA ray Fixed in 2.43.0
- Fix · GHSA-w4rh-fgx7-q63m ray (PyPI) Fixed in 2.43.0 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux AI (RHEL AI) | Affected | No fix yet: Fix deferred |
Timeline
- 2026-10-02 Threatist record created from CVE-2025-1979
- 2026-10-03 Alias added: GHSA-w4rh-fgx7-q63m
References
Sources
- CVE-2025-1979 · CVE Program
- CVE-2025-1979 · NVD
- FIRST EPSS
- GHSA-w4rh-fgx7-q63m · GitHub Advisory Database · CC BY 4.0
- CVE-2025-1979 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences