Ray — Critical Browser-Based Remote Code Execution Vulnerability Actively Exploited in Artificial Intelligence Environments (CVE-2025-62593)

Publication date: August 18, 2026
Category: Vulnerability / Network Security

Introduction

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) recently added a critical vulnerability impacting the Ray distributed computing framework to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation in real-world attacks. Identified as CVE-2025-62593, the flaw exposes machine learning engineers and developers to remote code execution (RCE) vectors triggered through web browsers such as Mozilla Firefox and Apple Safari. The initial bypass discovery was credited to Oligo security researcher Avi Lumelsky, while the conceptualization of the DNS rebinding attack vector was devised by Jonathan Leitschuh, revealing an attack chain rapidly adopted by threat actors in automated cryptomining campaigns and botnets.

What is Ray? (General Analysis)

Ray is an open-source, Python-native distributed computing framework designed specifically to scale artificial intelligence (AI) and machine learning (ML) workloads. Due to its capacity to coordinate intensive compute clusters—frequently equipped with high-performance graphics processing units (GPUs)—Ray has become an essential tool across modern AI research and development pipelines.

However, the software’s architecture historically prioritized iteration speed over strict perimeter security controls. As project maintainers pointed out, the historical absence of authentication on critical control-plane endpoints exposes task management services to unauthorized access. When combined with local development environments where engineers run active framework instances, the system becomes highly vulnerable to web-based attacks if the user visits compromised websites or is exposed to malicious advertising (malvertising).

The official metric data confirmed for this vulnerability includes:

  • Primary CVE: CVE-2025-62593
  • Official CVSS Score (v4.0): 9.4 (CRITICAL)
  • Official CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
  • Official CWE Classification: CWE-94 (Improper Control of Generation of Code / Code Injection), CWE-352 (Cross-Site Request Forgery)
  • CISA KEV Catalog: Yes (Added in August 2026)

How Does It Work? (Technical Analysis)

The exploitation mechanism does not rely on complex memory corruption flaws, but rather on architectural design oversights and flawed assumptions regarding HTTP header validation controls in modern web browsers.

  • Initial Infection Flow and Exploit Entry: The attack initiates when a developer running a local Ray development instance (or within a private network) inadvertently visits a malicious website or is served an ad tainted via malvertising. The threat actor leverages a DNS rebinding attack to bypass the browser’s Same-Origin Policy.
  • Bypassing Defensive Controls: To mitigate external malicious calls toward the Ray API, developers relied on primitive validation inspecting the User-Agent header for the presence of the "Mozilla" string. However, per the fetch specification of modern web browsers, this header can be modified or spoofed. By bypassing this check, malicious scripts can interact directly with unauthenticated endpoints (/api/jobs and /api/job_agent/jobs/).
  • Code Execution and Lateral Movement: Once communication with the Ray API is established through the browser—acting as a “confused deputy” intermediary—the attacker can inject and execute arbitrary shell code directly on the victim’s machine. Furthermore, this vector can be extended to target network-adjacent Ray instances running within private corporate networks, facilitating internal pivoting.

ເຈ้าของโปรเจกต์ระบุว่า: “Due to the longstanding decision by the Ray Development team to not implement any sort of authentication on critical endpoints, like /api/jobs & /api/job_agent/jobs/ has once again led to a severe vulnerability that allows attackers to execute arbitrary code against Ray.”

“Due to the longstanding decision by the Ray development team to not implement any sort of authentication on critical endpoints, the combination of DNS rebinding attacks and HTTP header manipulation allows external threat actors to execute arbitrary commands on developers’ workstations.”

Affected Systems / Environments

The vulnerability directly impacts Ray Python package installations prior to the patched release. The impact matrix is structured as follows:

CVECategory (CWE)ImpactCVSSVector (summary)
CVE-2025-62593CWE-94, CWE-352Browser-based RCE (Firefox/Safari)9.4 (CRITICAL)Network / Low Complexity / No Privileges / User Interaction Required
  • Affected Software: Python package ray in versions prior to 2.52.0.
  • Risk Profiles: Local development environments, machine learning engineer workstations, misconfigured cloud compute clusters, and deployments exposing management ports to web browser contexts.
  • Associated Threats: Integration into the RondoDox DDoS botnet infrastructure and malicious GPU-based cryptomining campaigns targeting NVIDIA clusters under the moniker ShadowRay 2.0.

Mitigation and Detection

Remediation

Engineering teams and system administrators must immediately apply remediation measures to prevent exploitation across development and production environments:

  1. Software Update: Upgrade the ray Python package to version 2.52.0 or later, which introduces robust patches to counteract the API validation bypass.
  2. Network Hardening and Segmentation: Avoid exposing Ray development interfaces and management ports (such as port 8265 or control plane endpoints) to public networks or interfaces accessible by generic web browsers.
  3. Secure Browsing Policies: Implement perimeter security controls and DNS filtering solutions (such as DNS sinkholing or response policy zones) to mitigate DNS rebinding attack attempts.

Detection

For Blue Team incident response personnel, monitoring access logs for anomalous calls to /api/jobs endpoints originating from unexpected sources is paramount.

  • Process and Network Monitoring: Watch for unusual shell command executions spawned by Python processes or web browser interactions on developer workstations.
  • Indicators of Compromise (IoCs): Track unusual outbound connections to Command and Control (C2) nodes linked to cryptomining botnets or anomalous HTTP traffic manipulating the User-Agent header when interacting with local Ray ports.
bash 
# Example quick query in network or proxy logs to detect suspicious requests targeting the Ray API
grep -E "(/api/jobs|/api/job_agent/jobs/)" /var/log/nginx/access.log | awk '{print $1, $7, $9}'

Wrapping Up

The CVE-2025-62593 vulnerability in Ray highlights how design assumptions tied to local development contexts—such as assuming web browsers cannot interact with internal unauthenticated APIs—can be catastrophically abused through advanced techniques like DNS rebinding and HTTP header manipulation. The rapid adoption of this vector by threat actors to power DDoS botnets and cryptomining farms (ShadowRay 2.0) underscores the urgent need for strict authentication and secure design practices across modern AI infrastructure platforms.

References