The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical remote code execution (RCE) flaw impacting the Ray distributed computing framework to its Known Exploited Vulnerabilities (KEV) catalog. This addition, designated CVE-2025-62593 with a CVSS score of 9.4, signals evidence of active exploitation in the wild.
This vulnerability enables remote code execution via web browsers like Mozilla Firefox and Apple Safari, leveraging DNS rebinding attacks against unauthenticated Ray endpoints. The issue primarily affects developers running Ray in development or testing environments.
✓
WHY IT MATTERS
- **AI/ML Supply Chain Risk:** Ray’s extensive adoption in scaling AI and machine learning workloads, with over 43,500 GitHub stars, makes this RCE a significant threat to AI development pipelines and inference systems.
- **Architectural Security Deficiencies:** The vulnerability highlights a longstanding architectural decision within Ray to not implement authentication on critical API endpoints, necessitating external security controls often not universally applied.
- **Immediate Remediation Mandate:** Inclusion in the KEV catalog requires federal agencies to prioritize urgent remediation under Binding Operational Directive (BOD) 26-04, setting a critical precedent for all organizations leveraging Ray.
Technical & Architectural Context
CVE-2025-62593 facilitates remote code execution through a combination of DNS rebinding and insufficient browser-based attack controls. The core vulnerability stems from Ray’s critical endpoints, such as `/api/jobs` and `/api/job_agent/jobs/`, lacking inherent authentication. Historically, Ray has expected to operate within a trusted network environment, with security and isolation enforced externally.
The attack vector involves a developer, running Ray locally, inadvertently visiting a malicious website or encountering a malicious advertisement. This site then initiates a DNS rebinding attack, causing the browser to route requests to the local Ray instance, bypassing typical same-origin policy protections. The vulnerability exploits an insufficient defense that relies on checking the User-Agent header for “Mozilla,” a check easily circumvented as the fetch specification allows User-Agent modification.
Successful exploitation allows arbitrary shell code execution on the developer’s machine. Furthermore, the attack can extend to network-adjacent Ray instances by using the browser as a confused deputy. This critical flaw has been addressed in Ray version 2.52.0.
STRIDING TECH WIRE
•
WEEKLY RADAR
Weekly Technology Briefings
Multi-source tech synthesis, primary research breakdowns, and high-impact insights delivered every Sunday morning.
Strategic Outlook & Next Milestones
The active exploitation of CVE-2025-62593 underscores the critical need for immediate patching to Ray version 2.52.0 or later. Organizations are advised to implement robust network segmentation and stringent access controls for all Ray deployments, especially those exposed even indirectly to untrusted networks. While Ray has begun implementing token-based authentication as an opt-out feature in version 2.52.0, with plans to make it default in future releases, a proactive approach to security is paramount.
Enterprises leveraging Ray for AI/ML operations must review their deployment architectures, ensuring adherence to zero-trust principles and robust perimeter defenses. This incident highlights the ongoing challenge of securing widely adopted open-source frameworks where default configurations may prioritize ease of use over stringent security. The CISA KEV listing mandates immediate action for federal agencies and serves as a strong recommendation for all other organizations to promptly remediate.
