CISA Flags Actively Exploited Ray Flaw That Can Trigger Browser
CISA added actively exploited Ray flaw CVE-2025-62593 (CVSS 9.4) to its KEV catalog; the DNS rebinding RCE has powered crypto-mining and DDoS botnet campaigns.
CISA added CVE-2025-62593 (CVSS 9.4) to its Known Exploited Vulnerabilities catalog, citing active exploitation of a DNS rebinding-driven RCE flaw in the Ray distributed computing framework, fixed in version 2.52.0. The flaw stems from missing authentication on critical Ray endpoints and an insufficient User-Agent header guard, exploitable against developers running Ray in Firefox or Safari via malicious websites or ads. RondoDox botnet operators incorporated the PoC exploit before the November 26, 2025 disclosure, and unpatched GPU-equipped clusters were hijacked into self-replicating crypto-mining botnets in the ShadowRay 2.0 campaign. FCEB agencies must apply fixes by August 20, 2026.
- Ray maintainers credited Oligo's Avi Lumelsky and Jonathan Leitschuh for the fetch bypass and DNS rebinding chain
- Attack can target network-adjacent Ray instances inside corporate networks using the browser as a confused deputy
- RondoDox added the PoC exploit two days before public disclosure in November 2025
- ShadowRay 2.0 turned unpatched NVIDIA GPU clusters into self-replicating crypto-mining botnets
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-62593 | Actively Exploited Browser-Based RCE in Ray AI Compute Engine Ray, the open-source AI compute engine, is vulnerable to a critical remote code execution flaw (CVE-2025-62593, CWE-94/CWE-352) in versions prior to 2.52.0, caused by an insufficient guard against browser-based attacks: the software distinguishes browser traffic only by checking that the User-Agent header starts with 'Mozilla', but the fetch specification allows that header to be modified. An attacker can combine DNS rebinding with a crafted User-Agent so that a developer's Firefox or Safari browser silently sends malicious requests to locally running Ray services after the developer visits an attacker-controlled website or is served a malicious advertisement (malvertising). Successful exploitation yields full remote code execution on the machine running Ray, with high confidentiality, integrity and availability impact reflected in the CVSS 4.0 score of 9.4. Affected users are developers running Ray as a development tool on any version before 2.52.0, which is the fixed release. The flaw is being actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-17, a public proof of concept is available in the project's GitHub security advisory (GHSA-q279-jhrf-cc6v), and EPSS estimates a 16.9% probability of exploitation in the next 30 days. Do: Upgrade Ray to version 2.52.0 or later immediately, in line with CISA KEV and BOD 26-04 patching requirements. Until patched, avoid browsing untrusted websites (including ad-serving pages) while Ray development services are running, and restrict network access to locally running Ray services. Focus triage on machines where developers use Firefox or Safari alongside Ray, and hunt for signs of compromise since the flaw is actively exploited. | 9.4 | 17% | KEV PoC |
| largeTens of thousands of developer machines/environments running vulnerable Ray (estimate) |
Full article492 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananAug 18, 2026Vulnerability / Network Security
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a critical flaw impacting Ray to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.
Ray is an open-source, Python-native distributed computing framework designed to scale artificial intelligence and machine learning workloads. As of writing, the GitHub project has more than 43,500 stars and has been forked over 7,900 times.
The vulnerability in question relates to CVE-2025-62593 (CVSS score: 9.4), which can result in remote code execution via web browsers like Mozilla Firefox and Apple Safari by means of a DNS rebinding attack.
"Due to the longstanding decision by the Ray Development team to not implement any sort of authentication on critical endpoints, like the /api/jobs & /api/job_agent/jobs/ has once again led to a severe vulnerability that allows attackers to execute arbitrary code against Ray," according to an advisory shared by Ray maintainers in November 2025. "This time in a development context via the browsers Firefox and Safari."
The issue, at its core, stems from insufficient controls against browser-based attacks, specifically scenarios where the User-Agent header can be modified.
"Combined with a DNS rebinding attack against the browser, and this vulnerability is exploitable against a developer running Ray who inadvertently visits a malicious website, or is served a malicious advertisement," the project maintainers added.
It's worth noting that the defect primarily impacts developers running development/testing environments with Ray. Should a targeted victim fall prey to a phishing attack, or be served a malicious ad, it can lead to the execution of arbitrary shell code on their machine.
The project maintainers also noted that the attack can also be extended to attack network-adjacent instances of Ray by leveraging the browser as a confused deputy intermediary to target Ray instances running inside a private corporate network.
The issue has been addressed in version 2.52.0 of the Python package. Ray has credited Oligo security researcher Avi Lumelsky with discovering the fetch bypass and Jonathan Leitschuh for coming up with the DNS rebinding attack.
CISA has not shared any details of how the vulnerability is being exploited in the wild. However, a BitSight report from March 2026 revealed that the threat actors behind the RondoDox DDoS botnet had incorporated the vulnerability into their arsenal two days before it was publicly disclosed on November 26, 2025, because of the availability of a proof-of-concept (PoC) exploit.
According to Oligo, unpatched Ray instances have also been at the receiving end of cyber attacks that aim to turn infected clusters with NVIDIA GPUs into a self-replicating cryptocurrency mining botnet as part of a campaign dubbed ShadowRay 2.0.
In light of active exploitation of CVE-2025-62593, Federal Civilian Executive Branch (FCEB) agencies are recommended to apply necessary fixes and mitigations by August 20, 2026.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2026/08/cisa-flags-actively-exploited-ray-flaw.html