Key Takeaways
- CISA added CVE‑2025-62593 (CVSS 9.4) affecting the Ray distributed‑computing framework to its Known Exploited Vulnerabilities (KEV) catalog due to active exploitation.
- The flaw stems from missing authentication on critical Ray endpoints (/api/jobs, /api/job_agent/jobs/) and can be triggered via a DNS rebinding attack using Firefox or Safari browsers.
- Developers running Ray in dev/test environments are the primary targets; a visit to a malicious site or ad can lead to arbitrary code execution on their machines.
- The vulnerability can also be used as a “confused deputy” to reach Ray instances inside private corporate networks.
- Patched in Ray 2.52.0; credit goes to Oligo researcher Avi Lumelsky (fetch bypass) and Jonathan Leitschuh (DNS rebinding technique).
- Threat actors incorporated the exploit into the RondoDox DDoS botnet before public disclosure and have used unpatched Ray clusters with NVIDIA GPUs to build a self‑replicating cryptocurrency‑mining botnet (ShadowRay 2.0).
- Federal Civilian Executive Branch (FCEB) agencies must apply fixes or mitigations by August 20, 2026.
Overview of CISA’s KEV Addition
On Monday, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) announced that it had added a critical vulnerability impacting the Ray framework to its Known Exploited Vulnerabilities (KEV) catalog. The decision was based on credible evidence of active exploitation in the wild. By placing CVE‑2025-62593 on the KEV list, CISA signals to federal agencies and private‑sector defenders that immediate remediation is required. This action follows CISA’s routine practice of prioritizing vulnerabilities that are both severe and actively being used by adversaries, thereby helping organizations focus patching efforts where they are needed most. The addition underscores the growing risk posed by weaknesses in widely adopted open‑source AI/ML tooling.
What Is Ray and Why It Matters
Ray is an open‑source, Python‑native distributed computing framework purpose‑built to scale artificial intelligence and machine learning workloads. Since its inception, the project has garnered substantial community support, evidenced by over 43,500 stars and more than 7,900 forks on GitHub as of the time of writing. Ray enables developers to parallelize Python code across clusters of machines with minimal code changes, making it a popular choice for research labs, startups, and large enterprises alike. Its ease of use and performance benefits have led to widespread adoption in both development/testing environments and production AI pipelines, which amplifies the potential impact of any security flaw within the framework.
Technical Details of CVE‑2025-62593
The vulnerability tracked as CVE‑2025-62593 carries a CVSS base score of 9.4, reflecting its high severity. It allows remote code execution (RCE) when an attacker successfully executes a DNS rebinding attack against a victim’s web browser—specifically Mozilla Firefox or Apple Safari. The exploit leverages the fact that Ray’s development server exposes certain HTTP endpoints without any authentication mechanism. Notably, the endpoints /api/jobs and /api/job_agent/jobs/ are accessible to anyone who can reach the Ray instance, opening a dangerous avenue for attackers who can manipulate a victim’s browser to issue requests to those endpoints.
How the Attack Works: Missing Auth and DNS Rebinding
At the heart of the issue is Ray’s longstanding decision to forgo authentication on critical administrative endpoints. This design choice, while convenient for rapid iteration during development, leaves those endpoints exposed to any entity capable of sending HTTP requests to them. When combined with a DNS rebinding technique, an attacker can trick a victim’s browser into believing it is communicating with a legitimate internal host while actually sending requests to the attacker‑controlled domain. The browser’s User‑Agent header can be altered to bypass simple checks, further facilitating the exploit. Consequently, a developer who inadvertently visits a malicious website—or is served a malicious advertisement—can have their browser act as a proxy that submits arbitrary commands to the locally running Ray server, resulting in full remote code execution on the developer’s machine.
Typical Attack Vectors for Developers
The primary victims of this flaw are developers who run Ray in local or sandboxed environments for testing AI/ML models. A typical attack chain begins with the victim clicking a link to a malicious site or loading a compromised advertisement that hosts the exploit payload. The malicious content triggers a DNS rebinding attack, causing the victim’s browser to repeatedly resolve a domain to the attacker’s server and then to the localhost IP where Ray is listening. Subsequent requests to the unauthenticated /api/jobs endpoint allow the attacker to submit arbitrary job specifications, which Ray executes with the privileges of the host process. In practice, this can lead to the execution of arbitrary shell commands, installation of malware, or theft of sensitive data stored on the developer’s workstation.
Extending the Threat to Internal Networks
Beyond compromising individual developer machines, the vulnerability can be pivoted to target Ray instances that reside inside private corporate networks. In this scenario, the attacker’s payload uses the victim’s browser as a “confused deputy”: the browser, believing it is still interacting with an external site, actually sends authenticated‑looking requests to internal Ray services via the victim’s internal IP address. Because the browser originates from within the trusted network perimeter, many network‑based defenses (such as firewalls or intrusion‑detection systems) may not inspect or block the traffic. This enables an external adversary to reach and exploit internal Ray deployments, potentially leading to broader compromise of AI workloads, data pipelines, or GPU‑accelerated resources housed within the organization.
Patch Availability and Credits
The Ray development team addressed the vulnerability in version 2.52.0 of the Python package, which introduces proper authentication checks on the previously exposed endpoints. Maintainers have publicly credited Oligo security researcher Avi Lumelsky for discovering the fetch bypass that made the endpoints reachable without authentication, and Jonathan Leitschuh for devising the DNS rebinding attack vector that leverages browsers as the exploitation medium. Users are strongly urged to upgrade to Ray 2.52.0 or later as soon as possible; the release notes detail the specific changes and provide guidance for verifying that the authentication controls are active.
Observed Exploitation in the Wild
Although CISA has not disclosed the exact nature of the observed attacks, a BitSight report from March 2026 revealed that the threat actors behind the RondoDox DDoS botnet had incorporated CVE‑2025-62593 into their toolkit just two days before the vulnerability was publicly disclosed on November 26, 2025. The early adoption was facilitated by the availability of a proof‑of‑concept (PoC) exploit that circulated in underground forums shortly after the flaw was identified. Furthermore, Oligo researchers have observed unpatched Ray instances being conscripted into a campaign dubbed ShadowRay 2.0, where attackers hijack clusters equipped with NVIDIA GPUs to create a self‑replicating cryptocurrency‑mining botnet. These incidents illustrate how a seemingly niche development‑environment flaw can be repurposed for large‑scale financial gain and disruptive activity.
Guidance for Federal Agencies and Best Practices
In light of the active exploitation, CISA has issued a binding operational directive requiring Federal Civilian Executive Branch (FCEB) agencies to apply the necessary fixes or mitigations by August 20, 2026. Recommended actions include upgrading to Ray 2.52.0 or later, enforcing network segmentation that isolates development environments from production systems, and implementing browser‑level protections such as disabling DNS rebinding via enterprise‑wide proxy configurations or using browsers with built‑in safeguards. Organizations should also consider deploying endpoint detection and response (EDR) solutions that can detect anomalous localhost requests originating from browsers, and conduct regular vulnerability scans targeting internal Ray instances. Beyond patching, adopting a zero‑trust mindset—where no service, even those running locally, is implicitly trusted—will help mitigate similar risks in the future.
Broader Implications for AI/ML Infrastructure Security
The CVE‑2025-62593 episode highlights a growing trend: vulnerabilities in widely used open‑source AI/ML frameworks are becoming attractive targets for financially motivated and disruptive threat actors. As AI workloads increasingly rely on distributed computing platforms like Ray, the attack surface expands to include not only traditional server‑side flaws but also client‑side weaknesses that can be exploited via browsers. This case underscores the importance of securing development environments with the same rigor applied to production systems, employing strong authentication, least‑privilege principles, and continuous monitoring. By learning from incidents such as ShadowRay 2.0 and RondoDox, the AI community can build more resilient pipelines that protect both intellectual property and the computational assets that power modern machine learning innovations.