erroneo.us
Search all guides⌘K

Security Digest · Nov 26, 2025 · Vulnerability · AI / LLM

Ray CVE-2025-62593: Browser-Driven RCE Against Ray Devs

Pre-2.52.0 Ray dashboards can be driven to run code from a malicious page in Firefox or Safari. In KEV since Aug 2026. Upgrade dev machines to 2.52.0+.

Published By erroneo.us Security Desk · Updated 3 min read9 sources

Our verdict

Patch this week

Upgrade Ray to 2.52.0 or later on developer machines and internal clusters this week; the attack needs a Firefox or Safari user to load a hostile page while a pre-2.52 dashboard is running, and the public evidence of real-world use is thin.

Who must act: Developers and data scientists who run Ray below 2.52.0 locally or on internal clusters and browse with Firefox or Safari, and any team whose Ray dashboard is reachable from employee browsers or the internet.

Who can relax: Teams already on Ray 2.52.0 or later (ideally with token authentication on) and machines that never run a local Ray dashboard; Chrome users were not exposed to this specific browser path.

Affected
Ray (PyPI: ray) before 2.52.0
Fixed in
Ray 2.52.0 (current: 2.59.0, which enables token auth by default for local clusters)
CVSS
9.4 (v4.0, CNA)
EPSS
62.5% (percentile 99)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
Critical

What to do

  1. Find every Ray install (pip show ray, plus images and lockfiles) and upgrade to 2.52.0 or later; 2.59.0 is current.
  2. Turn on token authentication: set RAY_AUTH_MODE=token before starting clusters (on by default for local clusters from 2.59).
  3. Make sure no Ray dashboard (port 8265 by default) is reachable from the internet; use SSH tunnels or kubectl port-forward instead.
  4. Stop Ray dashboards on laptops when not in use, and keep them off machines used for general browsing where possible.
  5. Treat any Ray dashboard that was internet-reachable as a compromise candidate and review its job history.

How to check if you are affected or compromised

  • Run ray job list against each cluster and look for jobs you did not submit.
  • Review job-driver-*.log files under /tmp/ray/session_latest/logs for unexpected shell commands (Ray clears these on reboot, so check before restarting).
  • Look in dashboard or proxy logs for POST requests to /api/jobs/ or /api/job_agent/jobs/ from unexpected sources.
  • Check developer machines for unexpected processes or outbound connections started by the Ray worker process.

What happened#

On November 26, 2025, the Ray project published GHSA-q279-jhrf-cc6v (CVE-2025-62593, CVSS 4.0 9.4). It describes a remote code execution path against developers who run Ray, the Python framework for distributing AI and ML workloads.

Ray's dashboard exposes a Jobs API that runs whatever command it is given and, by long-standing design, requires no authentication. To keep web pages from abusing it, Ray rejected job submissions whose User-Agent started with "Mozilla", on the assumption that browsers cannot change that header. Firefox and Safari do let page scripts change it. Combined with DNS rebinding, a malicious website or ad can make the victim's browser submit a job to a Ray dashboard running on the developer's machine or elsewhere on the internal network. Avi Lumelsky of Oligo identified the bypass, and Jonathan Leitschuh, then at Socket, developed the rebinding attack and disclosed it.

Ray 2.52.0 fixes it. The fix also rejects requests that carry the Sec-Fetch-* headers browsers attach automatically, and 2.52.0 adds optional token authentication.

Who is affected#

All Ray versions before 2.52.0 are affected. The realistic victim is someone with a Ray dashboard running (port 8265 by default) who browses the web in Firefox or Safari: a data scientist with a local cluster, a developer testing jobs, or an engineer whose browser can reach an internal Ray cluster. The advisory says Chrome was not exploitable this way, because of a Chrome quirk that blocks the header change. That protects Chrome users from this path only.

Ray is often installed indirectly, so check virtual environments, notebooks and container images, not just the packages you pinned yourself.

Do you really need to act?#

Yes, but on a normal patch cycle. CISA added this 2025 bug to KEV on August 17, 2026, with a three-day federal deadline. It has not said what exploitation it saw. The only public evidence is Bitsight's March 2026 analysis of the RondoDox botnet, which added an exploit for this CVE on November 24, 2025, two days before the CVE was published. Bitsight notes that the botnet's requests used a User-Agent beginning with "Mozilla", which the old check rejects, so it believes that implementation would not have worked. Whatever newer evidence CISA has is not public as of October 21, 2026.

Keep two cases apart. If your Ray dashboard is reachable from the internet, attackers do not need a browser at all. The unauthenticated Jobs API is the ShadowRay problem (CVE-2023-48022), covered in our separate brief. Upgrading alone does not fix that, because token authentication was off by default until 2.59. If your dashboard is local or internal, this CVE is the reason to upgrade: one visit to a hostile page can run code with the developer's own permissions. The Cloud Security Alliance stresses that internet exposure is not required.

What to do now#

  1. Find installs with pip show ray or python -c "import ray; print(ray.__version__)", then run pip install -U "ray>=2.52.0". The current release is 2.59.0.
  2. Enable token authentication by exporting RAY_AUTH_MODE=token before ray start. From 2.59, local clusters turn it on by default, and Ray says 2.61 will extend that to all clusters.
  3. Keep port 8265 off the internet. Reach remote dashboards through ray dashboard SSH tunnels or kubectl port-forward.
  4. Shut down local dashboards when you are not using them, and rebuild images that pin older Ray versions.

How to tell if you were hit#

Run ray job list --address http://127.0.0.1:8265, or point it at each cluster, and look for submissions you do not recognize. Job output is written to job-driver-*.log under /tmp/ray/session_latest/logs. Ray clears that directory on reboot, so collect it before restarting. In proxy or dashboard logs, look for POST requests to /api/jobs/ or /api/job_agent/jobs/ that you cannot explain. On developer machines, look for unexpected child processes or outbound connections from Ray workers. If you find any, treat the machine's credentials as exposed: SSH keys, cloud tokens and Git credentials.

Timeline#

  • — Ray 2.52.0 published to PyPI.
  • — First RondoDox use of this CVE observed, according to Bitsight.
  • — Advisory and CVE published.
  • — Bitsight publishes its RondoDox analysis.
  • — CISA adds CVE-2025-62593 to KEV.
  • — CISA remediation deadline for federal agencies.

Vulnerability records

  • CVE-2025-62593 · KEV 2026-08-17 · Ray is an AI compute engine. Prior to version 2.52.0, developers working with Ray as a development tool can be exploited via a critical RCE vulnerability…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. Ray — GHSA-q279-jhrf-cc6v: Critical RCE against Ray devs via browser (Safari and Firefox) due to DNS rebinding github.com
  2. CVE record — CVE-2025-62593 cve.org
  3. NVD — CVE-2025-62593 nvd.nist.gov
  4. CISA — Known Exploited Vulnerabilities: CVE-2025-62593 cisa.gov
  5. Ray — Fix commit: add denial of fetch headers (#58553) github.com
  6. Ray documentation — Token authentication docs.ray.io
  7. Bitsight — RondoDox Botnet: From Zero to 174 Exploited Vulnerabilities bitsight.com
  8. Cloud Security Alliance — Ray Framework RCE Under Active Exploitation Joins CISA KEV labs.cloudsecurityalliance.org

Coverage and analysis

  1. The Hacker News — CISA Flags Actively Exploited Ray Flaw That Can Trigger Browser-Based RCE thehackernews.com