---
title: "Ray CVE-2025-62593: Browser-Driven RCE Against Ray Devs"
url: https://erroneo.us/security/briefs/ray-cve-2025-62593-browser-dns-rebinding-rce/
description: "Pre-2.52.0 Ray dashboards can be driven to run code from a malicious page in Firefox or Safari. In KEV since Aug 2026. Upgrade dev machines to 2.52.0+."
type: security-brief
section: "Security Digest"
date_published: 2025-11-26
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Patch this week"
cves: ["CVE-2025-62593"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Ray CVE-2025-62593: Browser-Driven RCE Against Ray Devs

**Verdict: Patch this week.** Upgrade Ray to 2.52.0 or later on developer machines and internal clusters this week; the attack needs a Firefox or Safari user to load a hostile page while a pre-2.52 dashboard is running, and the public evidence of real-world use is thin.

- **Who must act:** Developers and data scientists who run Ray below 2.52.0 locally or on internal clusters and browse with Firefox or Safari, and any team whose Ray dashboard is reachable from employee browsers or the internet.
- **Who can relax:** Teams already on Ray 2.52.0 or later (ideally with token authentication on) and machines that never run a local Ray dashboard; Chrome users were not exposed to this specific browser path.
- **Affected:** Ray (PyPI: ray) before 2.52.0
- **Fixed:** Ray 2.52.0 (current: 2.59.0, which enables token auth by default for local clusters)
- **CVEs:** CVE-2025-62593
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Find every Ray install (pip show ray, plus images and lockfiles) and upgrade to 2.52.0 or later; 2.59.0 is current.
2. Turn on token authentication: set RAY_AUTH_MODE=token before starting clusters (on by default for local clusters from 2.59).
3. Make sure no Ray dashboard (port 8265 by default) is reachable from the internet; use SSH tunnels or kubectl port-forward instead.
4. Stop Ray dashboards on laptops when not in use, and keep them off machines used for general browsing where possible.
5. Treat any Ray dashboard that was internet-reachable as a compromise candidate and review its job history.

### How to check if you are affected

- Run ray job list against each cluster and look for jobs you did not submit.
- Review job-driver-*.log files under /tmp/ray/session_latest/logs for unexpected shell commands (Ray clears these on reboot, so check before restarting).
- Look in dashboard or proxy logs for POST requests to /api/jobs/ or /api/job_agent/jobs/ from unexpected sources.
- Check developer machines for unexpected processes or outbound connections started by the Ray worker process.

## What happened

On November 26, 2025, the Ray project published [GHSA-q279-jhrf-cc6v](https://github.com/ray-project/ray/security/advisories/GHSA-q279-jhrf-cc6v) (CVE-2025-62593, CVSS 4.0 9.4). It describes a remote code execution path against developers who run Ray, the Python framework for distributing AI and ML workloads.

Ray's dashboard exposes a Jobs API that runs whatever command it is given and, by long-standing design, requires no authentication. To keep web pages from abusing it, Ray rejected job submissions whose User-Agent started with "Mozilla", on the assumption that browsers cannot change that header. Firefox and Safari do let page scripts change it. Combined with DNS rebinding, a malicious website or ad can make the victim's browser submit a job to a Ray dashboard running on the developer's machine or elsewhere on the internal network. Avi Lumelsky of Oligo identified the bypass, and Jonathan Leitschuh, then at Socket, developed the rebinding attack and disclosed it.

Ray 2.52.0 fixes it. The [fix](https://github.com/ray-project/ray/commit/70e7c72780bdec075dba6cad1afe0832772bfe09) also rejects requests that carry the `Sec-Fetch-*` headers browsers attach automatically, and 2.52.0 adds optional token authentication.

## Who is affected

All Ray versions before 2.52.0 are affected. The realistic victim is someone with a Ray dashboard running (port 8265 by default) who browses the web in Firefox or Safari: a data scientist with a local cluster, a developer testing jobs, or an engineer whose browser can reach an internal Ray cluster. The advisory says Chrome was not exploitable this way, because of a Chrome quirk that blocks the header change. That protects Chrome users from this path only.

Ray is often installed indirectly, so check virtual environments, notebooks and container images, not just the packages you pinned yourself.

## Do you really need to act?

Yes, but on a normal patch cycle. CISA added this 2025 bug to [KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-62593) on August 17, 2026, with a three-day federal deadline. It has not said what exploitation it saw. The only public evidence is [Bitsight's March 2026 analysis](https://www.bitsight.com/blog/rondodox-botnet-infrastructure-analysis) of the RondoDox botnet, which added an exploit for this CVE on November 24, 2025, two days before the CVE was published. Bitsight notes that the botnet's requests used a User-Agent beginning with "Mozilla", which the old check rejects, so it believes that implementation would not have worked. Whatever newer evidence CISA has is not public as of October 21, 2026.

Keep two cases apart. If your Ray dashboard is reachable from the internet, attackers do not need a browser at all. The unauthenticated Jobs API is the ShadowRay problem (CVE-2023-48022), covered in our separate brief. Upgrading alone does not fix that, because token authentication was off by default until 2.59. If your dashboard is local or internal, this CVE is the reason to upgrade: one visit to a hostile page can run code with the developer's own permissions. The [Cloud Security Alliance](https://labs.cloudsecurityalliance.org/research/csa-research-note-ray-cve-2025-62593-active-exploitation-202/) stresses that internet exposure is not required.

## What to do now

1. Find installs with `pip show ray` or `python -c "import ray; print(ray.__version__)"`, then run `pip install -U "ray>=2.52.0"`. The current release is 2.59.0.
2. Enable [token authentication](https://docs.ray.io/en/latest/ray-security/token-auth.html) by exporting `RAY_AUTH_MODE=token` before `ray start`. From 2.59, local clusters turn it on by default, and Ray says 2.61 will extend that to all clusters.
3. Keep port 8265 off the internet. Reach remote dashboards through `ray dashboard` SSH tunnels or `kubectl port-forward`.
4. Shut down local dashboards when you are not using them, and rebuild images that pin older Ray versions.

## How to tell if you were hit

Run `ray job list --address http://127.0.0.1:8265`, or point it at each cluster, and look for submissions you do not recognize. Job output is written to `job-driver-*.log` under `/tmp/ray/session_latest/logs`. Ray clears that directory on reboot, so collect it before restarting. In proxy or dashboard logs, look for POST requests to `/api/jobs/` or `/api/job_agent/jobs/` that you cannot explain. On developer machines, look for unexpected child processes or outbound connections from Ray workers. If you find any, treat the machine's credentials as exposed: SSH keys, cloud tokens and Git credentials.

## Timeline

- Nov 21, 2025 — Ray 2.52.0 published to PyPI.
- Nov 24, 2025 — First RondoDox use of this CVE observed, according to Bitsight.
- Nov 26, 2025 — Advisory and CVE published.
- Mar 11, 2026 — Bitsight publishes its RondoDox analysis.
- Aug 17, 2026 — CISA adds CVE-2025-62593 to KEV.
- Aug 20, 2026 — CISA remediation deadline for federal agencies.

## Sources

1. [Ray — GHSA-q279-jhrf-cc6v: Critical RCE against Ray devs via browser (Safari and Firefox) due to DNS rebinding](https://github.com/ray-project/ray/security/advisories/GHSA-q279-jhrf-cc6v)
2. [CVE record — CVE-2025-62593](https://www.cve.org/CVERecord?id=CVE-2025-62593)
3. [NVD — CVE-2025-62593](https://nvd.nist.gov/vuln/detail/CVE-2025-62593)
4. [CISA — Known Exploited Vulnerabilities: CVE-2025-62593](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-62593)
5. [Ray — Fix commit: add denial of fetch headers (#58553)](https://github.com/ray-project/ray/commit/70e7c72780bdec075dba6cad1afe0832772bfe09)
6. [Ray documentation — Token authentication](https://docs.ray.io/en/latest/ray-security/token-auth.html)
7. [Bitsight — RondoDox Botnet: From Zero to 174 Exploited Vulnerabilities](https://www.bitsight.com/blog/rondodox-botnet-infrastructure-analysis)
8. [Cloud Security Alliance — Ray Framework RCE Under Active Exploitation Joins CISA KEV](https://labs.cloudsecurityalliance.org/research/csa-research-note-ray-cve-2025-62593-active-exploitation-202/)
9. [The Hacker News — CISA Flags Actively Exploited Ray Flaw That Can Trigger Browser-Based RCE](https://thehackernews.com/2026/08/cisa-flags-actively-exploited-ray-flaw.html)

---
Source page: https://erroneo.us/security/briefs/ray-cve-2025-62593-browser-dns-rebinding-rce/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt