CISA Adds Critical Ray Vulnerability to KEV Catalog Amid Active Exploitation

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical vulnerability affecting the Ray distributed computing framework to its Known Exploited Vulnerabilities (KEV) catalog, citing confirmed evidence of active exploitation.

Ray, an open‑source Python‑native framework used to scale AI and machine‑learning workloads, is widely deployed across research and production environments. The project has more than 43,500 GitHub stars and thousands of forks, making the impact of any security flaw potentially significant.

The vulnerability, tracked as CVE‑2025‑62593 with a CVSS score of 9.4, enables remote code execution through browsers such as Mozilla Firefox and Apple Safari via a DNS rebinding attack. According to Ray maintainers, the issue stems from the long‑standing absence of authentication on critical API endpoints, including /api/jobs and /api/job_agent/jobs/. This design decision has repeatedly exposed developers to high‑severity risks, and in this case allowed attackers to execute arbitrary code in development environments.

The weakness centers on insufficient protections against browser‑based attacks, particularly scenarios where the User‑Agent header can be manipulated. When combined with DNS rebinding, a developer running Ray locally can be compromised simply by visiting a malicious website or being served a malicious advertisement. Attackers can then execute arbitrary shell code on the victim’s machine.

Ray maintainers also warned that the attack can extend beyond local development setups. By abusing the browser as a confused‑deputy intermediary, attackers can target Ray instances running inside private corporate networks, effectively turning the browser into a bridge to internal systems.

The flaw has been patched in Ray version 2.52.0. The project credited Oligo researcher Avi Lumelsky for identifying the fetch bypass and Jonathan Leitschuh for developing the DNS rebinding attack technique.

CISA has not disclosed details about in‑the‑wild exploitation, but a BitSight report from March 2026 revealed that operators of the RondoDox DDoS botnet incorporated the vulnerability two days before its public disclosure, aided by the availability of a proof‑of‑concept exploit. Oligo also reported that unpatched Ray clusters equipped with NVIDIA GPUs have been targeted in a campaign dubbed ShadowRay 2.0, which attempts to convert infected systems into self‑replicating cryptocurrency‑mining botnets.

Federal Civilian Executive Branch agencies have been instructed to apply patches and mitigations for CVE‑2025‑62593 no later than August 20, 2026, due to confirmed active exploitation.