Ray logging exposed Redis password in plaintext
Ray, a distributed Python framework, had a vulnerability in versions before 2.43.0 where Redis passwords were logged in plaintext in standard logging output. The vulnerability was disclosed and patched in February 2025.
What happened
Ray, a distributed Python framework, logged Redis passwords in plaintext when redis password authentication was used. When a Redis password was passed as an argument, it would be written to standard logging output.
Reported impact
The vulnerability could lead to password exposure if logging was enabled, Redis was using password authentication, and logs were accessible to an attacker with network access to the Redis instance.
Index analysis
The issue was fixed in Ray version 2.43.0, which redacts the Redis password in logs. The fix was merged on February 11, 2025.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.