CISA Flags Actively Exploited Ray Flaw That Can Trigger Browser-Based RCE
CISA added CVE-2025-62593 (CVSS 9.4) to its Known Exploited Vulnerabilities catalog due to active exploitation of a critical flaw in the Ray distributed computing framework The vulnerability enables browser-based remote code execution via DNS rebinding attacks targeting unauthenticated Ray API endpoints such as /api/jobs and /api/job_agent/jobs/ The root cause is Ray's longstanding decision to omit authentication on critical endpoints, combined with insufficient User-Agent header validation Thre
Analysis
TL;DR
- CISA added CVE-2025-62593 (CVSS 9.4) to its Known Exploited Vulnerabilities catalog due to active exploitation of a critical flaw in the Ray distributed computing framework
- The vulnerability enables browser-based remote code execution via DNS rebinding attacks targeting unauthenticated Ray API endpoints such as /api/jobs and /api/job_agent/jobs/
- The root cause is Ray's longstanding decision to omit authentication on critical endpoints, combined with insufficient User-Agent header validation
- Threat actors including the RondoDox DDoS botnet and ShadowRay 2.0 cryptocurrency mining campaigns have already weaponized the flaw in the wild
- The fix is available in Ray version 2.52.0, with CISA recommending FCEB agencies apply mitigations by August 20, 2026
Why It Matters
This vulnerability highlights a critical intersection between AI infrastructure security and real-world exploit chains, demonstrating how open-source ML frameworks with default-unauthenticated endpoints become high-value targets for threat actors. For AI practitioners and organizations running Ray clusters, this underscores the urgent need to audit authentication configurations on development and production environments, especially those exposed to network-adjacent or internet-facing deployments.
Technical Details
- CVE-2025-62593 (CVSS 9.4) allows remote code execution through a DNS rebinding attack that exploits the ability to modify the User-Agent header in browsers like Firefox and Safari, tricking Ray's server into treating a malicious browser request as a trusted internal call
- The attack vector targets unauthenticated critical API endpoints (/api/jobs and /api/job_agent/jobs/), enabling arbitrary shell code execution on a developer's machine when they visit a malicious website or are served a malicious advertisement
- The vulnerability can be extended laterally to compromise Ray instances within private corporate networks by using the browser as a "confused deputy" intermediary, bypassing network perimeter defenses
- Discovered by Oligo security researcher Avi Lumelsky (fetch bypass) and Jonathan Leitschuh (DNS rebinding attack), with the fix released in Ray version 2.52.0
- Active exploitation evidence includes the RondoDox DDoS botnet incorporating the flaw two days before public disclosure due to an available PoC, and ShadowRay 2.0 campaigns converting infected NVIDIA GPU clusters into self-replicating cryptocurrency mining botnets
Industry Insight
- Organizations running Ray in development or production should immediately audit all exposed Ray endpoints for authentication gaps and upgrade to version 2.52.0 or later; default-no-auth configurations on ML infrastructure represent a systemic risk that extends beyond a single framework
- The rapid weaponization of this vulnerability—exploited by threat actors before public disclosure—reinforces the importance of responsible disclosure timelines and the need for continuous vulnerability monitoring on open-source AI/ML tooling
- AI infrastructure teams should treat development environments with the same security rigor as production, as attackers are increasingly targeting the developer workflow itself as an entry point into broader corporate networks through confused deputy attacks.
Disclaimer: The above content is generated by AI and is for reference only.