CISA has added CVE-2025-62593, a critical code-injection flaw in the Ray AI compute engine, to its Known Exploited Vulnerabilities catalog after confirming active exploitation — and the attack chain can start from an ordinary web page in Firefox or Safari via DNS rebinding.
The vulnerability affects Ray versions before 2.52.0 and carries a CVSS 4.0 score of 9.4. The U.S. Cybersecurity and Infrastructure Security Agency added the flaw to its actively exploited KEV catalog on August 17, 2026, and federal agencies have until August 20 to remediate it under BOD 26-04.
Key Takeaways
- CVE-2025-62593 is a critical (9.4) code-injection flaw in Ray, the open-source distributed AI compute engine, affecting versions before 2.52.0.
- The attack is browser-based: DNS rebinding turns Firefox or Safari into a relay to a local Ray dashboard, bypassing weak User-Agent defenses.
- CISA added it to its KEV catalog on August 17, 2026 after evidence of active exploitation; federal remediation deadline is August 20.
- Fix: upgrade to Ray 2.52.0 or later, which patches the flaw and adds a disabled-by-default token authentication option.
What Is CVE-2025-62593?
Ray is a Python-native distributed computing framework used to scale AI and machine learning workloads, with more than 43,500 GitHub stars. The flaw is rooted in a longstanding design decision: the Ray dashboard exposes critical endpoints such as /api/jobs and /api/job_agent/jobs/ without authentication. According to the GitHub security advisory published in November 2025, this "has once again led to a severe vulnerability that allows attackers to execute arbitrary code against Ray." The NVD entry classifies it under CWE-94 (code injection) and CWE-352 (cross-site request forgery).
How the Browser-Based Attack Works
The interesting part is the attack surface: it is not limited to network-adjacent attackers. Ray's dashboard tried to block browser traffic by checking whether the request's User-Agent header starts with "Mozilla". That heuristic is insufficient, because the fetch specification allows web pages to set a custom User-Agent — and Firefox and Safari permit this, while Chrome happens to block it due to a browser bug.
Researchers combined that gap with a DNS rebinding attack. If a developer running Ray visits a malicious site or is served a malicious ad, the site can rebind its domain to 127.0.0.1 and submit requests to the local Ray dashboard as if they came from the browser's own origin, executing arbitrary shell commands. The public PoC uses NCC Group's Singularity framework and can also target Ray instances inside a private corporate network by using the browser as a confused-deputy intermediary.
Why It Matters for AI and Developer Workflows
Ray is the orchestration layer behind many training and inference pipelines, so a compromise can expose model code, datasets, and internal tooling. This is not just a hypothetical risk: The Hacker News reported that the RondoDox DDoS botnet had already incorporated the vulnerability into its arsenal two days before public disclosure, and unpatched Ray instances have been used to turn NVIDIA GPU clusters into a self-replicating cryptocurrency mining botnet in the ShadowRay 2.0 campaign. If you are building AI coding workflows on local services, this is a concrete reminder that local tooling is an attack surface; the same goes for CI workflow exposure via coding agents.
What to Do Now
- Upgrade Ray to 2.52.0 or later immediately — the patched release also adds a disabled-by-default token authentication option for the dashboard.
- Review local and network-adjacent Ray deployments for unnecessary exposure, especially ports such as 8265 and 6379.
- Monitor the KEV catalog and vendor advisories for follow-on guidance, the same pattern as the recently exploited CISA SharePoint flaw.
- Assume compromise if Ray was reachable from a browser-connected network: audit running jobs, shell history, and GPU/CPU utilization for mining workloads.
Conclusion
CISA’s KEV listing and the August 20 federal remediation deadline make this a near-term action item for any team running Ray. The browser-based trigger lowers the barrier to exploitation enough that even local development instances count as exposed — upgrade to 2.52.0, enable token authentication if you cannot upgrade immediately, and treat the flaw as a critical patch priority rather than a routine update. Are you running any Ray versions older than 2.52.0? Let us know in the comments what your upgrade plan looks like.
{"@context":"https://schema.org","@type":"FAQPage","mainEntity":[{"@type":"Question","name":"What is CVE-2025-62593?","acceptedAnswer":{"@type":"Answer","text":"It is a critical (CVSS 9.4) code-injection vulnerability in Ray, the open-source distributed AI compute engine, affecting versions before 2.52.0. It allows remote code execution via browser-based attacks involving DNS rebinding."}},{"@type":"Question","name":"Which Ray versions are affected?","acceptedAnswer":{"@type":"Answer","text":"All versions before 2.52.0 are affected. The flaw was patched in version 2.52.0, which also introduced a disabled-by-default token authentication feature for the dashboard."}},{"@type":"Question","name":"Why does the attack involve Firefox and Safari?","acceptedAnswer":{"@type":"Answer","text":"Ray's dashboard blocked requests whose User-Agent header starts with \"Mozilla\". Firefox and Safari allow web pages to set a custom User-Agent via the fetch API, so the block can be bypassed. Chrome currently blocks that behavior due to a browser bug."}},{"@type":"Question","name":"How do I fix the Ray vulnerability?","acceptedAnswer":{"@type":"Answer","text":"Upgrade Ray to version 2.52.0 or later. Also review local and network-adjacent Ray deployments for unnecessary exposure, and consider enabling token authentication if the dashboard is reachable from a browser-connected network."}}]}
Frequently asked questions
What is CVE-2025-62593?
It is a critical (CVSS 9.4) code-injection vulnerability in Ray, the open-source distributed AI compute engine, affecting versions before 2.52.0. It allows remote code execution via browser-based attacks involving DNS rebinding.
Which Ray versions are affected?
All versions before 2.52.0 are affected. The flaw was patched in version 2.52.0, which also introduced a disabled-by-default token authentication feature for the dashboard.
Why does the attack involve Firefox and Safari?
Ray's dashboard blocked requests whose User-Agent header starts with "Mozilla". Firefox and Safari allow web pages to set a custom User-Agent via the fetch API, so the block can be bypassed. Chrome currently blocks that behavior due to a browser bug.
How do I fix the Ray vulnerability?
Upgrade Ray to version 2.52.0 or later. Also review local and network-adjacent Ray deployments for unnecessary exposure, and consider enabling token authentication if the dashboard is reachable from a browser-connected network.
Sources: CISA KEV Catalog Alert, NVD CVE-2025-62593, Ray GitHub Security Advisory, The Hacker News
Top comments (0)