The Cybersecurity and Infrastructure Security Agency has added CVE-2025-62593, a critical remote code execution flaw in the Ray distributed computing framework, to its Known Exploited Vulnerabilities catalog and imposed an unusually short three-day remediation window on US federal civilian agencies under Binding Operational Directive 26-04.[6][10] CISA’s catalog entry describes the issue as a code-injection weakness that can be exploited against Ray deployments and notes that the deadline for federal remediation has been accelerated to August 20, 2026, reflecting evidence of active exploitation in the wild.[6][10][4]
CVE-2025-62593 affects Ray installations prior to version 2.52.0 and targets developers running Ray locally as a development or testing tool while browsing the web in Firefox or Safari.[1][2][3] The vulnerability stems from Ray’s attempt to block browser-originated requests by checking whether the User-Agent header begins with the string “Mozilla,” a defense that fails because modern browsers’ Fetch API allows scripts to modify that header.[1][3][8] Attackers can combine that weakness with a DNS rebinding attack so that a developer’s visit to a malicious website or a malicious advertisement results in arbitrary code execution against the Ray process on the local machine.[1][2][3][7] Security researchers note that Google Chrome is currently not a viable vehicle for this exploit due to a separate browser bug, leaving Firefox and Safari users at particular risk.[7]
The flaw is especially dangerous because it abuses the browser as a “confused deputy,” letting an attacker pivot from the public internet into Ray instances running inside private corporate networks.[3][9] Ray exposes HTTP API endpoints such as /api/jobs and /api/job_agent/jobs/ that historically lacked authentication, allowing unauthenticated users to submit workloads or job control commands once they can reach the service.[2][3] The project’s own advisory and third-party analyses point to Ray’s longstanding security model—which assumed clusters would run inside a trusted, isolated network and delegated access control to surrounding infrastructure—as a key factor in making this browser-based RCE possible.[3][2][9] Red Hat rates the issue 8.8 under CVSS 3.1 due to the need for user interaction and DNS rebinding, while Ray’s advisory assigns a 9.4 score under CVSS 4.0, underscoring its critical impact.[2][4][3]
Ray has become a popular open source framework for scaling Python and machine learning workloads from a developer’s laptop to distributed clusters with minimal code changes, and is widely used across AI and data engineering teams.[7][10] That ubiquity means many organizations may have Ray running on developer workstations that bridge the public internet and sensitive internal environments, creating an attractive target for threat actors looking to move laterally from a compromised browser session into high-value systems.[7][9] With CISA now confirming active exploitation of CVE-2025-62593, development and security teams should assume that opportunistic attackers and more sophisticated groups alike are probing for unpatched Ray instances.[6][10]
The Ray project has issued a fix in Ray 2.52.0, closing the RCE path and introducing built-in token-based authentication across components including the dashboard, CLI, API clients and internal services.[1][14] Release notes and vulnerability write-ups indicate that token authentication is initially disabled by default, requiring administrators to opt in and configure it—typically by setting an environment variable such as RAY_AUTH_MODE=token and provisioning secrets for clients.[14][13][11] CISA’s guidance to federal agencies is clear: either apply the vendor’s mitigation and update Ray to at least version 2.52.0 or discontinue use of vulnerable versions by the remediation deadline.[6][10]
Organizations outside the US federal government should treat CVE-2025-62593 with similar urgency by identifying any Ray deployments, especially on developer laptops and workstations, and upgrading those environments to Ray 2.52.0 or later.[1][4][7] Security teams should also consider enabling Ray’s token-based authentication, restricting network access to Ray dashboards and APIs, and monitoring for suspicious traffic indicative of DNS rebinding or unexpected browser-originated requests to Ray endpoints.[9][13][2] Given the combination of widespread Ray adoption, the low barrier to exploitation via a malicious website, and CISA’s confirmation of active attacks, leaving pre-2.52.0 Ray installations exposed is likely to become increasingly untenable.[6][7][10]
References
- CVE-2025-62593 Detail – NVD
- CVE-2025-62593 – Red Hat Customer Portal
- CVE-2025-62593: Ray is vulnerable to Critical RCE via Safari …
- CVE-2025-62593: CISA Flags Ray RCE, Update to 2.52.0
- CISA Adds Actively Exploited Ray Browser-Based RCE to KEV
- Critical Ray AI Flaw Exposes Devs via Safari & Firefox (CVE-2025-62593)
- Warning: Critical #RCE vulnerability CVE-2025-62593 CVSS:9.4 …
- CVE-2025-62593: Ray API RCE via DNS Rebinding
- CISA orders a three-day patch after a flaw in the Ray AI framework …
- Ray’s New Token Authentication is Disabled By Default
- CVE-2025-34351: Ray Package Token Authentication …
- Ray – Browse /ray-2.52.0 at SourceForge.net
