---
schema: 1
kind: vulnerability
title: "CVE-2025-62593 — Ray's dashboard is defended against browsers by a User-Agent string check, and CISA now records the DNS-rebinding bypass as exploited"
headline: "A developer's own browser is the attack path into a local Ray cluster — CISA catalogued the flaw as exploited on 17 August"
summary: >
  CISA added CVE-2025-62593 to its Known Exploited Vulnerabilities catalog on 2026-08-17, recording
  confirmed exploitation of a code-injection flaw in Ray, the distributed-computing framework widely used
  for machine-learning and data-engineering workloads. Ray's dashboard exposes unauthenticated job-submission
  endpoints by design, and the only guard against browser-borne requests is a check that the User-Agent
  header begins with "Mozilla" — which Firefox and Safari allow a page to overwrite through fetch(). Combined
  with DNS rebinding, a developer who visits a malicious page or is served a malicious advertisement has
  their own browser used as a proxy into a Ray instance that was never exposed to the internet, yielding code
  execution on the host. Fixed in Ray 2.52.0, which is also the first release to offer authentication at all —
  and it is disabled by default.
discovered_at: "2026-08-18T04:40:00Z"
event_date: "2026-08-17"
run_id: 2026-08-18T0410Z-intel
priority: high
immediate_action: null
tags: [vulnerabilities, actively-exploited, cisa-kev, rce, pre-auth, default-config, ai-abuse, patch-available]
regions: [global, europe]
sectors: [public-sector, education, technology]
entities: []
techniques: [T1189, T1059.006, T1210]
affected_products: ["Ray"]
cves:
  - id: CVE-2025-62593
    cvss: "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H (Critical)"
    epss: null
    type: rce
    vector: user-interaction
    auth: pre-auth
    status: [exploited, cisa-kev, patch-available]
    affected: "< 2.52.0"
    fixed: "2.52.0"
sources:
  - url: "https://github.com/ray-project/ray/security/advisories/GHSA-q279-jhrf-cc6v"
    publisher: "Ray project (GitHub Security Advisory)"
    date: "2025-11-26"
    role: primary
  - url: "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"
    publisher: "CISA — Known Exploited Vulnerabilities Catalog"
    date: "2026-08-17"
    role: primary
closed_sources: []
evidence:
  - quote: "Developers using Ray as a development tool may be exposed to this vulnerability exploitable through Firefox and Safari."
    publisher: "CISA — Known Exploited Vulnerabilities Catalog"
  - quote: "This vulnerability is due to an insufficient guard against browser-based attacks, as the current defense uses the"
    publisher: "Ray project (GitHub Security Advisory)"
verification: multi-source
sourcing_note: >
  Two assessors: the Ray project for the mechanism and the fix, and CISA for the exploitation determination.
  The advisory itself dates to 2025-11-26 — the in-window development is the catalogue listing, which is what
  moves the flaw from theoretical to confirmed-exploited. No party has published a description of the observed
  in-the-wild activity, named an exploiting cluster, or given a victim profile, so this entry claims
  exploitation on CISA's determination alone and nothing more. The catalogue's remediation date is a United
  States federal compliance deadline and carries no weight for this constituency.
confidence: high
update_of: null
references: []
deep_dive: false
deep_dive_category: null
org_triage: null
classification:
  reliability: A
  credibility: 1
watchlist_hit: false
actions:
  - "Inventory Ray installations on developer, research and data-engineering endpoints — including local `ray start` clusters that were never considered internet-facing — upgrade them to 2.52.0 or later, and explicitly enable the authentication feature that release adds, because it ships disabled."
migrated_from: null
---

CISA added CVE-2025-62593 to its Known Exploited Vulnerabilities catalog on 2026-08-17, describing it as a code-injection flaw in Ray and noting that "Developers using Ray as a development tool may be exposed to this vulnerability exploitable through Firefox and Safari" ([CISA KEV, catalogue version 2026.08.17](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)). The underlying advisory is not new — the Ray project published it on 2025-11-26 — but the exploitation determination is, and it changes the flaw's standing from a documented design weakness to something being used.

The design decision behind it is stated plainly by the project: Ray's dashboard exposes job-submission endpoints, including `/api/jobs` and `/api/job_agent/jobs/`, without authentication, and the guard against browser-originated requests is a heuristic on the User-Agent header. As the advisory puts it, "This vulnerability is due to an insufficient guard against browser-based attacks, as the current defense uses the `User-Agent` header starting with the string 'Mozilla' as a defense mechanism" ([Ray project, 2025-11-26](https://github.com/ray-project/ray/security/advisories/GHSA-q279-jhrf-cc6v)). That assumption holds only where the browser refuses to let a page set the header. Firefox and Safari implement the fetch specification and permit it; Chrome does not, which the advisory notes is the result of a long-standing bug that puts Chrome out of spec — so the browser most likely to be *non*-compliant is the one that happens to be safe.

The reason this reaches hosts that no firewall would consider exposed is DNS rebinding. The attacker does not need network reach to the Ray dashboard; the victim's browser has it. A developer running Ray locally who visits a malicious page — or is served a malicious advertisement, which the advisory calls out explicitly — gives that page a path to resolve an attacker-controlled hostname to a loopback or internal address, overwrite the User-Agent, and POST a job to the dashboard, which executes it. The advisory further states the same browser-as-intermediary path can be turned against network-adjacent Ray instances, so a single developer workstation reaches cluster nodes that were never meant to be addressable from outside. The fix is Ray 2.52.0, which the project notes also, finally, adds an authentication feature — one that is disabled by default, so upgrading alone leaves the endpoints open to anything that can already reach them.

**Detection, telemetry class first.** The observable sequence is a browser process making a local or internal HTTP request it has no business making. In DNS and resolver telemetry, the rebinding step is a hostname whose answer changes to a loopback or RFC 1918 address within a short TTL window on a host that has just browsed externally — the classic signature, and the one that fires before anything reaches Ray. In the Ray dashboard's own access logs, the anchor is a POST to the job-submission endpoints carrying an Origin or Referer that names an external site rather than local tooling. In host process and network telemetry, correlate an outbound browser session with a subsequent connection to the dashboard port (8265 by default) from that same browser process, and then with Ray spawning a job-worker process tree that no scheduler or CLI invocation accounts for. **Triage:** legitimate dashboard traffic comes from the Ray CLI, a notebook kernel or an IDE extension — local, non-browser processes with no cross-origin headers, and job submissions that correlate with a developer's own session. Browser-originated POSTs to those endpoints have no benign equivalent, and the DNS answer that recently pointed elsewhere is the corroborating half.

**Defender takeaway:** the exposure here is not on an asset inventory, because the vulnerable service is bound to a developer's own machine and the attacker arrives through the browser rather than the network. For this constituency the population to check is research computing, data-engineering and machine-learning environments in federal and cantonal bodies, universities and public research institutes, where Ray is run as a local development tool rather than a managed platform. Upgrading to 2.52.0 closes the User-Agent bypass; turning on the authentication that release introduces is the part that survives the next variant of the same idea, and it will not happen by itself.