The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has officially added the critical ray ai vulnerability cve-2025-62593 to its Known Exploited Vulnerabilities (KEV) catalog. This inclusion signals that threat actors are actively weaponizing the flaw in the wild, prompting an urgent mandate for Federal Civilian Executive Branch (FCEB) agencies to apply patches by August 20, 2026.
Ray is a highly popular open-source, Python-native distributed computing framework used extensively to scale artificial intelligence (AI) and machine learning (ML) workloads. With over 43,000 stars on the official GitHub project, it is a foundational tool for developers building next-generation AI applications.
The vulnerability, detailed in the official security advisory and rated with a critical CVSS score of 9.4, allows attackers to achieve Remote Code Execution (RCE) via web browsers such as Mozilla Firefox and Apple Safari through a sophisticated DNS rebinding attack.
Technical Breakdown: How CVE-2025-62593 Works
The root cause of this vulnerability lies in the longstanding architectural decision by the Ray development team to omit authentication on critical API endpoints, specifically /api/jobs and /api/job_agent/jobs/. Instead of robust authentication, the system relied on an insufficient security control: checking if the HTTP User-Agent header started with the string “Mozilla.”
This inadequate check opened the door for browser-based attacks. When combined with a DNS rebinding technique, the vulnerability becomes highly exploitable. If a developer running an unpatched Ray instance in a development or testing environment inadvertently visits a malicious website or is served a malicious advertisement, the attacker can bypass the User-Agent restriction.
Once bypassed, the attacker can execute arbitrary shell code directly on the developer’s machine. Furthermore, attackers can use the compromised browser as a “confused deputy” to pivot and attack network-adjacent Ray instances running deep inside a private corporate network.
| Vulnerability Detail | Information |
|---|---|
| CVE Identifier | CVE-2025-62593 |
| CVSS Score | 9.4 (Critical) |
| Attack Vector | DNS Rebinding via Web Browser (Firefox/Safari) |
| Impact | Remote Code Execution (RCE) / System Takeover |
| Patched Version | Ray Version 2.52.0 |
Active Exploitation: RondoDox and ShadowRay 2.0
While CISA has not publicly detailed specific incidents triggering the KEV addition, independent cybersecurity researchers have tracked active exploitation of this flaw across multiple threat campaigns.
Security firm BitSight reported that the threat actors operating the RondoDox DDoS botnet incorporated a proof-of-concept (PoC) for this vulnerability into their exploit arsenal shortly before its public disclosure. RondoDox is known for its “exploit-shotgun” approach, aggressively scanning the internet to compromise vulnerable endpoints.
Additionally, researchers at Oligo Security have observed unpatched Ray instances being targeted by a sophisticated campaign dubbed ShadowRay 2.0. This campaign specifically hunts for AI infrastructure clusters equipped with expensive NVIDIA GPUs. Once compromised, the clusters are hijacked and forced into a self-replicating cryptocurrency mining botnet, draining enterprise computational resources.
Immediate Remediation Steps
Organizations utilizing the Ray framework must take immediate action to secure their AI development pipelines. The most critical step is to upgrade the Python package to version 2.52.0 or later, which addresses the flawed User-Agent validation logic.
Beyond patching, security teams should isolate AI development environments from the broader corporate network and enforce strict zero-trust network access (ZTNA) policies to prevent “confused deputy” lateral movement attacks.
Related Resource: For more insights on how AI infrastructure is being targeted, read our guide on Agentic AI Cybersecurity Threats in 2026.
FAQ: ray ai vulnerability cve-2025-62593
What is the Ray AI framework?
Ray is an open-source, Python-based distributed computing framework used by developers and data scientists to scale artificial intelligence and machine learning workloads across multiple nodes or clusters.
How does a DNS rebinding attack work in this context?
A DNS rebinding attack tricks a developer’s web browser into interacting with a malicious domain that suddenly resolves to an internal IP address (like the local Ray dashboard). Because the browser thinks it is still talking to the original website, it bypasses Same-Origin Policy (SOP) protections, allowing the attacker to send unauthorized commands to the local application.
Is authentication available for the Ray API?
Historically, the Ray development team explicitly chose not to implement authentication on critical endpoints like /api/jobs to prioritize ease of use in isolated environments. This architectural choice is the root cause of this vulnerability.
What is the ShadowRay 2.0 botnet?
ShadowRay 2.0 is an active threat campaign that exploits unpatched Ray clusters to hijack their computational power (specifically NVIDIA GPUs) for illicit cryptocurrency mining.
Reported by CyberUpdates365 Desk
Delivering the latest insights on enterprise security, federal AI directives, and the future of IT infrastructure. Follow us for daily updates on how technology is reshaping the corporate landscape.
