Overview
CISA added CVE-2025-62593 (CVSS 9.4) to its Known Exploited Vulnerabilities (KEV) catalog on August 18, 2026, confirming active exploitation of a critical flaw in Ray, the widely used open-source Python framework for scaling AI and machine learning workloads. The vulnerability enables remote code execution (RCE) through browser-based DNS rebinding attacks, targeting developers running Ray locally or within private corporate networks. With over 43,500 GitHub stars, Ray is deeply embedded in AI/ML development pipelines, making the attack surface significant.
Technical Analysis
The root cause of CVE-2025-62593 is Ray’s longstanding decision not to implement authentication on critical API endpoints, including /api/jobs and /api/job_agent/jobs/. This architectural gap was previously flagged but not remediated, and it has now been weaponised in a new attack path.
The exploit chain works as follows:
- DNS Rebinding Setup: An attacker hosts a malicious website or serves a malicious advertisement. When a developer using Firefox or Safari visits the page, the attacker leverages DNS rebinding to make the browser believe the attacker’s domain resolves to
127.0.0.1(localhost). - User-Agent Bypass: Insufficient controls on the
User-Agentheader allow browser-originated requests to reach Ray’s unauthenticated API endpoints. - Confused Deputy Attack: The victim’s browser is used as a proxy to submit job requests to Ray’s local or network-adjacent API, resulting in execution of arbitrary shell code on the developer’s machine.
- Network Pivot: The technique can be extended to target Ray instances running inside private corporate networks, using the developer’s browser as a confused deputy intermediary.
The flaw was discovered by Oligo Security researcher Avi Lumelsky (fetch bypass) and Jonathan Leitschuh (DNS rebinding vector). It was disclosed in November 2025 and patched in Ray version 2.52.0.
Framework Mapping
- AML.T0047 (AI-Enabled Product or Service): Ray is core AI/ML infrastructure; exploitation directly impacts AI workload integrity and availability.
- AML.T0040 (AI Model Inference API Access): Unauthenticated job submission APIs are the direct attack surface exploited.
- AML.T0010 (AI Supply Chain Compromise): Exploitation of developer tooling used to build and scale AI systems constitutes a supply chain risk.
- LLM05 (Supply Chain Vulnerabilities): The unpatched framework represents a vulnerable dependency in AI development pipelines.
- LLM07 (Insecure Plugin Design): Absence of authentication on critical API endpoints mirrors insecure plugin/service design patterns.
Impact Assessment
Exploitation is actively occurring across multiple threat actor campaigns. The RondoDox DDoS botnet incorporated the exploit two days before its public disclosure in November 2025, suggesting pre-patch intelligence. A separate campaign, ShadowRay 2.0, has been observed converting compromised NVIDIA GPU clusters into self-replicating cryptocurrency mining botnets. The blast radius includes individual developers, enterprise AI teams, and any organisation running Ray in environments reachable from a browser context.
Mitigation & Recommendations
- Patch immediately: Upgrade to Ray 2.52.0 or later, which addresses CVE-2025-62593.
- Restrict API access: Apply network-level controls (firewall rules, localhost binding) to prevent external access to Ray’s job API endpoints.
- Browser hygiene: Developers should avoid browsing untrusted sites while running local Ray instances.
- Monitor GPU utilisation: Unexplained spikes may indicate cryptomining compromise via ShadowRay 2.0.
- FCEB compliance deadline: Federal agencies must apply mitigations by August 20, 2026 per CISA guidance.