A malicious web page can run commands on machines running Ray

On 17 August 2026 CISA added CVE-2025-62593 to its catalog of known exploited vulnerabilities, citing evidence of active exploitation. The vulnerability sits in Ray, described in the security advisory as an AI compute engine, and it affects every version before 2.52.0. CISA named the entry «Ray-Project Ray Code Injection Vulnerability», and set 20 August 2026 as the due date for United States federal agencies. The Ray project disclosed the vulnerability on 26 November 2025, almost nine months before it entered the catalog.

What happens technically

The vulnerability sits in the Ray dashboard, specifically the /api/jobs and /api/job_agent/jobs/ endpoints. Those endpoints require no authentication, and the security advisory from the Ray project ties that explicitly to a longstanding decision in the project not to put authentication on them. The defence against requests from a browser has instead been that Ray rejects anything whose User-Agent header starts with the string «Mozilla», meaning whatever looks like it came from a browser. That block does not hold, because the fetch interface in Firefox and Safari lets a web page set User-Agent to a different value and thereby slip past it. The weakness is classified both as CWE-94, code injection, and as CWE-352, cross site request forgery. In the catalog CISA uses only the first of those two names.

The attack has two parts. First the browser of a developer running Ray locally has to reach Ray at all. That is solved with a DNS rebinding attack, a known technique where a domain the attacker controls resolves to a local address once the page has loaded, so the browser believes it is still talking to the attacker's site. The page then sends a request to the jobs endpoint carrying commands that Ray executes. According to the advisory the result is that arbitrary shell commands can run on the developer's machine, and it is enough for the victim to visit a malicious website or be served a malicious advertisement. The fix arrived in Ray 2.52.0, which also ships an authentication feature that is disabled by default, and the advisory names no workaround for those who cannot upgrade. The sources differ on severity: the CNA GitHub set CVSS 4.0 to 9.4 and a severity of critical, while NVD set its own CVSS 3.1 to 8.8 and a severity of high. In its SSVC entry CISA assesses exploitation as active and automatable, and the technical impact as total. What the active exploitation consists of is stated neither by CISA nor by the Ray project. The only public account CISA itself points to is a Bitsight analysis of the RondoDox botnet, published on 11 March 2026 with observations running to 16 February 2026. Bitsight records that CVE-2025-62593 was first seen exploited on 24 November 2025, two days before the vulnerability was disclosed, and writes at the same time that the exploit code RondoDox uses does not work, because the botnet sends a User-Agent starting with «Mozilla» and therefore hits the very block the attack was meant to slip past. Bitsight states caveats about its own measurements. The analysis describes a botnet running denial of service attacks and cryptomining at scale, not the targeted browser attack against developer machines that the security advisory describes. The vulnerability was found by avilum of Oligo Security, who described the bypass of the User-Agent block, and by JLLeitschuh of Socket, who built the exploit code and handled disclosure.

What this means for you if you run Ray locally

This is not an attack on a server you put on the internet. It is an attack on the machine you are sitting at, and it is triggered by visiting a web page on an ordinary working day. If you run Ray locally and use Firefox or Safari, the boundary between internal and external gives you no protection, because the request originates in your own browser. Our assessment is that this is what makes the case uncomfortable. The control meant to stop attacks coming from a browser was a text string, and the attacker gets to choose that string. If your developer machine holds access to source code, keys and production environments, that machine is the one in the line of fire, not the cluster you run your models on.

Two questions deserve to come first. One is which Ray versions actually run in your organisation, and that question is often harder than it sounds, because Ray is installed as a package from the PyPI registry rather than as a system somebody operates. The other is whether anybody ran a vulnerable version between the advisory on 26 November 2025 and today. The 20 August 2026 due date applies to United States federal agencies and not to you, but it was set three days after the vulnerability was added, and it therefore says something about how fast CISA believes this has to be handled. Be aware at the same time that the picture of exploitation is unclear. CISA records active exploitation, while the only analysis CISA points to describes exploit code that does not work. That does not make the vulnerability less real, but it means the urgency rests on CISA's own assessment rather than on a documented incident. If your organisation is covered by NIS2, this is in any case a case where you have to show that vulnerability management also covers the tools your developers use, and not only the servers in production.

Berigo recommends

• Upgrade Ray to 2.52.0 or later everywhere, including on the developers' own machines. The advisory names no workaround that can replace the upgrade.
• Turn on the token authentication introduced in 2.52.0. It is disabled by default, so an upgrade alone does not give it to you.
• Map where Ray is actually installed. Look for the package in development environments, notebooks and build jobs, not only in production.
• Treat a vulnerable installation on a machine holding keys and source code as a question of compromise, and not merely as a missing update.
• Set a fixed internal deadline for vulnerabilities listed in the CISA catalog of known exploited vulnerabilities, and let that deadline cover developer tooling on the same terms as servers.