CISA KEV Alert: Ray's Browser-Triggered RCE Flaw Is Now Actively Exploited

Ray, the open-source distributed computing framework that underpins a large share of production AI/ML training and serving pipelines, has a critical vulnerability that CISA confirms is under active exploitation. CVE-2025-62593 (CVSS 9.4) was added to the U.S. Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog on August 17, 2026, giving Federal Civilian Executive Branch agencies until August 20, 2026 to patch or mitigate.

What makes this one unusual

Most RCE bugs need direct network access to the vulnerable service. This one doesn't. Ray's HTTP API — including endpoints like /api/jobs and /api/job_agent/jobs/ — relies on a User-Agent header check as a defense against cross-origin requests: if the header starts with Mozilla, the request is treated as coming from a real browser and handled more cautiously. The problem is that the fetch spec lets a webpage set an arbitrary User-Agent value, so that check is trivially bypassed.

Combine that with a DNS rebinding attack — where a malicious domain's DNS record is switched, post-connection, from an attacker-controlled IP to 127.0.0.1 or another local address — and a browser can be tricked into believing the attacker's server and the victim's local Ray dashboard share the same origin. A developer simply visiting a booby-trapped site (or one serving a malicious ad) in Firefox or Safari, with a Ray instance running locally or on the network, can trigger arbitrary code execution without clicking anything else.

Already weaponized

This isn't a patch-before-someone-notices situation. According to reporting from The Hacker News, the RondoDox DDoS botnet began incorporating the flaw roughly two days before its public disclosure in late November 2025. Separately, unpatched Ray deployments have been targeted in a campaign dubbed ShadowRay 2.0, which repurposes exposed GPU clusters for cryptocurrency mining — a pattern consistent with earlier Ray exposure incidents, where the framework's permissive-by-default dashboard has repeatedly been found accessible on the open internet.

The vulnerability was reported by Avi Lumelsky of Oligo Security, who identified the User-Agent fetch bypass, and Jonathan Leitschuh, who identified the DNS rebinding attack vector that turns the bypass into full RCE.

Why this matters beyond Ray

Ray is deliberately optimized for fast, low-friction distributed compute — its dashboard and job APIs are designed to be easy to reach from a cluster's worker nodes, which is exactly what makes them easy to reach from anywhere else if network segmentation is weak. This is a recurring pattern in AI/ML infrastructure tooling generally: frameworks built by and for data scientists prioritize developer velocity over authentication-by-default, and that tradeoff becomes a live exploitation path the moment a framework is popular enough to be worth targeting. Treat any Ray dashboard, job-submission API, or similar ML orchestration endpoint as sensitive infrastructure — not a convenience tool — and keep it off networks reachable from a developer's browser session.

What to do now

• Upgrade to Ray 2.52.0 or later, where the vulnerability is fixed.
• Until patched, do not expose the Ray dashboard or job APIs to networks reachable from a developer workstation's browser; bind them to localhost or an isolated management network.
• Audit existing Ray deployments for signs of the ShadowRay 2.0 cryptomining pattern (unexpected GPU utilization, unfamiliar scheduled jobs) and RondoDox botnet indicators.
• If you're a federal agency subject to CISA's KEV directive, treat the August 20, 2026 deadline as binding, not advisory.