CISA Confirms Active Exploitation of Ray CVE-2025-62593

CISA on August 17, 2026 added vulnerability CVE-2025-62593 (CVSS 9.4) to the Known Exploited Vulnerabilities catalog, confirming that it is being actively exploited. The vulnerability affects Ray — a popular open-source framework for scaling artificial intelligence and machine learning workloads — and allows an attacker to achieve remote execution of arbitrary code on a developer’s machine via a DNS rebinding attack in Firefox and Safari browsers. A fix is available in version 2.52.0; U.S. federal agencies are required to apply the patch by August 20, 2026.

Technical details of the vulnerability

The root cause of CVE-2025-62593 is a long-standing architectural decision by the Ray development team not to implement authentication on critical API endpoints, in particular /api/jobs and /api/job_agent/jobs/. This decision has already led to serious security issues in the past, and the current vulnerability is yet another consequence of it.

The attack is built on two components:

• Bypassing the User-Agent check: Ray uses the User-Agent header as the sole mechanism for distinguishing requests from browsers and programmatic clients. Researcher Avi Lumelsky from Oligo Security discovered a way to bypass this check (fetch bypass), which opens the possibility of sending arbitrary requests to the Ray API from the browser context.
• DNS rebinding: Researcher Jonathan Leitschuh demonstrated that, in combination with a DNS rebinding attack, an attacker can trick the victim’s browser into accessing a local Ray instance, bypassing Same-Origin Policy restrictions. It is enough for the developer to visit a malicious site or load a page containing malicious advertising.

The result of successful exploitation is the execution of arbitrary shell code on the victim’s machine. According to the official advisory, the attack can also be extended to Ray instances on the network inside a corporate environment: the developer’s browser is used as an intermediary agent (confused deputy) to access Ray instances that are not directly reachable from the internet.

Why this vulnerability is particularly dangerous

At first glance, the vulnerability primarily affects development and testing environments. However, this is precisely what makes it strategically valuable for attackers for several reasons:

• Privileged access: developers’ machines that work with Ray typically have access to internal repositories, secrets, API keys, and corporate networks. Compromising such a machine provides an entry point for lateral movement.
• GPU clusters: Ray is used to scale ML workloads, often on clusters with NVIDIA GPUs. Taking over these resources is attractive both for cryptomining and for building botnets.
• Project scale: the Ray repository on GitHub has more than 43,500 stars and over 7,900 forks, which indicates widespread adoption of the framework in the AI/ML industry.
• Low exploitation barrier: the attack does not require prior access to the victim’s infrastructure — it is enough to lure a developer to a malicious page or inject a malicious advertisement into a legitimate website.

Impact assessment

The highest risk is to organizations that use Ray for training and inference of machine learning models — companies in the financial technology, healthcare, autonomous transportation, and cloud AI services sectors. The DNS rebinding attack scenario is particularly insidious: the developer may not suspect a compromise, since the malicious request originates from their own browser.

The extension of the attack into the corporate network via the confused deputy mechanism means that even Ray instances that are not exposed to the internet are not protected if at least one developer with access to them uses a vulnerable browser. This turns a local development-environment vulnerability into a vector for infiltrating the internal infrastructure.

Remediation recommendations

1. Update Ray to version 2.52.0 or later. This is the primary measure that eliminates the vulnerability. Check the version with the command pip show ray.
2. Audit exposed Ray instances. Make sure that the /api/jobs and /api/job_agent/jobs/ endpoints are not accessible without authentication. Even after updating, it is recommended to restrict network access to the Ray Dashboard.
3. Isolate development environments. Ray instances in development and testing environments should be segmented from production infrastructure and critical internal resources.
4. Restrict DNS rebinding at the network level. Configure DNS resolvers to block responses that point to internal IP addresses (RFC 1918) for external domains. This reduces the overall risk of DNS rebinding.
5. Control browser security extensions. Extensions that block DNS rebinding (for example, settings enforced through corporate browser policies) add an additional layer of protection.

CISA has not disclosed details of specific incidents involving the exploitation of CVE-2025-62593, but its inclusion in the KEV catalog confirms that attacks have been observed. Given the critical CVSS score of 9.4, the low exploitation barrier, and the widespread use of Ray in AI/ML infrastructure, updating to version 2.52.0 should be a priority task for all teams using this framework — regardless of whether Ray runs in a production environment or only on developers’ machines.