The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has recently identified a significant security flaw in Ray, a popular open-source computing framework. This vulnerability, now part of CISA’s Known Exploited Vulnerabilities catalog, is being actively targeted, raising concerns among users.
Understanding the Ray Vulnerability
Ray is widely used for scaling artificial intelligence and machine learning tasks, with over 43,500 stars on GitHub. The flaw, designated as CVE-2025-62593, has been given a severity score of 9.4. The issue allows remote code execution through web browsers like Mozilla Firefox and Apple Safari via a DNS rebinding attack.
The vulnerability arises from the Ray Development team’s choice not to enforce authentication for critical endpoints, such as /api/jobs. This decision has left a gap that attackers can exploit to execute arbitrary code, especially in development environments.
Exploitation Tactics and Impact
By combining a DNS rebinding attack with browser vulnerabilities, attackers can target developers using Ray who unknowingly visit harmful websites or encounter malicious ads. These attacks can lead to unauthorized code execution on the victim’s machine.
The flaw primarily affects developers in testing settings but can also be used to compromise network-adjacent Ray instances. This is done by using the browser as an intermediary to attack Ray deployments within private networks. The problem has been resolved in Ray’s version 2.52.0, with acknowledgments to security researchers Avi Lumelsky and Jonathan Leitschuh.
Active Exploitation and Preventive Measures
Although CISA has not detailed the methods of exploitation, reports from BitSight indicate that the RondoDox botnet operators used the vulnerability shortly after it became public. Additionally, unpatched Ray installations have been targeted by the ShadowRay 2.0 campaign, which aims to convert affected clusters into cryptocurrency mining botnets.
Given the ongoing exploitation of CVE-2025-62593, federal agencies are advised to apply the necessary patches and follow mitigation strategies by August 20, 2026. Prompt action is crucial to protect systems from potential threats.
As cybersecurity threats evolve, staying informed and updating software regularly are essential steps in safeguarding digital environments. Users of Ray should ensure they are running the latest secure versions to avoid vulnerabilities.
