~/f4n6 $ grep -r "CVE-2025-62593 — Ray-Project Ray: Ray-Project Ray Code Injection Vulnerability" ./investigations/ --include="*.md"

CVE-2025-62593 — Ray-Project Ray: Ray-Project Ray Code Injection Vulnerability

Jeff Davies 17 Aug 2026 6 min read

1. Executive summary

CVE-2025-62593 is a CRITICAL code injection vulnerability (CVSS 9.4) in Ray-Project Ray, an open-source AI compute engine, affecting all versions prior to 2.52.0. The flaw allows remote code execution against developer workstations via a DNS rebinding attack combined with a flawed browser-based defense mechanism that relies solely on the User-Agent header. Exploitation requires only that a developer running Ray visits a malicious website or is served a malvertising payload in Firefox or Safari. EMEA financial services firms using Ray for AI/ML model training or distributed compute should treat this as a high-priority developer-workstation risk; the vulnerability is NOT currently listed in CISA KEV, though CISA SSVC rates exploitation as "poc" and technical impact as "total."

2. Regulatory framing

Article Trigger (the fact in this item) Practical impact
DORA Art. 24: digital operational resilience testing — general requirements Ray is an AI compute engine used in development pipelines; this CVE is exploitable via developer browsers with "total" technical impact (CISA SSVC), requiring assessment of whether Ray instances are exposed in tested environments. Firms running Ray in development or staging must include this vulnerability in their resilience testing scope and verify that Ray dashboards/APIs are not reachable from developer browsers on networks that also handle production data.
NIS2 Art. 21(2)(d): supply chain security measures Ray is an open-source third-party component in the AI/ML supply chain with a critical RCE that has a public proof-of-concept (CISA SSVC exploitation: "poc"). Organisations in NIS2 scope must evaluate Ray as a third-party component in their supply chain risk assessments and ensure version 2.52.0 or later is enforced across all development environments.

3. Technical analysis & attack chain

Affected versions: Ray-Project Ray < 2.52.0 (all versions prior to 2.52.0). Fixed version: 2.52.0. CWEs: CWE-94 (Improper Control of Generation of Code / Code Injection), CWE-352 (Cross-Site Request Forgery). CVSS 4.0 vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H CISA SSVC: Exploitation = "poc", Automatable = "no", Technical Impact = "total".

Attack chain

  1. Precondition — developer runs Ray locally or on accessible network. A developer is running a Ray cluster (dashboard/API server) on their workstation or on a network-reachable host. The Ray instance is in default or misconfigured state with the browser-based guard active.
  2. Attacker sets up malicious web content. The attacker creates a malicious website or purchases malvertising inventory. No prior knowledge of the victim's Ray instance is required beyond the expectation that the target is a developer who may be running Ray.
  3. DNS rebinding attack. The victim (developer) visits the malicious website or is served the malvertising payload in Firefox or Safari. The attacker's page initiates a DNS rebinding attack: the initial DNS resolution returns the attacker's server IP, but a subsequent resolution (after TTL expiry) returns an IP address on the victim's local network — typically 127.0.0.1 or a private network address where the Ray dashboard/API is listening.
  4. Bypass of the User-Agent defense. Ray's only defense against browser-based attacks is checking whether the User-Agent header starts with the string "Mozilla". This is insufficient because the Fetch specification allows JavaScript to set a custom User-Agent header via the fetch() API. The attacker's malicious page sends requests to the Ray API with a User-Agent that does NOT start with "Mozilla", bypassing the guard entirely.
  5. Code injection / RCE. With the browser-based guard bypassed and DNS rebinding providing network access to the Ray instance, the attacker sends crafted requests to Ray's API that trigger code injection (CWE-94), achieving remote code execution on the host running Ray. The CVSS vector indicates full impact across confidentiality, integrity, and availability for both the vulnerable system and subsequent systems (VC:H/VI:H/VA:H/SC:H/SI:H/SA:H).
  6. Observed impact. CISA SSVC rates technical impact as "total." The NVD record references a BitSight blog post on "Rondodox Botnet Infrastructure Analysis" (https://www.bitsight.com/blog/rondodox-botnet-infrastructure-analysis), suggesting possible observed malicious infrastructure activity associated with this vulnerability. This reference is single-sourced via the NVD change history (CISA-ADP added the URL); the nature of the relationship between Rondodox botnet and CVE-2025-62593 is not detailed in the provided source material — verify before drawing operational conclusions.

Key technical details

  • Vulnerable component: Ray dashboard/API server browser-based access control.
  • Defense mechanism (flawed): Checks if User-Agent header starts with "Mozilla". All modern browsers send User-Agent strings beginning with "Mozilla" due to historical compatibility; Ray assumed this header could not be spoofed by browser-originated requests.
  • Why it fails: The Fetch specification permits overriding the User-Agent header in JavaScript fetch() calls, allowing an attacker-controlled page to send requests with an arbitrary User-Agent string.
  • Attack vector: Network (AV:N), low attack complexity (AC:L), no privileges required (PR:N), user interaction required (UI:P) — the developer must visit a malicious page or be served a malvertising ad.
  • Browsers confirmed exploitable: Firefox and Safari (per NVD description). Chrome is not explicitly mentioned; this may reflect SameSite cookie enforcement differences or other browser-specific behaviour — the source does not elaborate.

4. Mitigation & containment

P1 — Within 24 hours

  1. Inventory Ray deployments. Identify all instances of Ray-Project Ray across development, staging, and production environments. Check version: python -c "import ray; print(ray.__version__)" or pip show ray.
  2. Restrict network exposure. Ensure Ray dashboard and API ports are NOT accessible from developer browsers on untrusted networks. Bind Ray to 127.0.0.1 only where cluster topology permits: ray start --dashboard-host=127.0.0.1 If Ray must bind to a network interface, enforce firewall rules limiting access to specific trusted IPs/subnets only.
  3. Block Ray dashboard ports at network egress. If developers work from corporate networks, add egress firewall rules blocking outbound connections to common Ray dashboard ports (default 8265) from developer workstations to prevent DNS rebinding from reaching local Ray instances.

P2 — Within 72 hours

  1. Upgrade to Ray 2.52.0 or later. This is the vendor-provided fix: pip install --upgrade "ray>=2.52.0" Verify the upgrade: python -c "import ray; print(ray.__version__)" — must report 2.52.0 or higher.
  2. Deploy EDR/browser controls. If Ray cannot be upgraded immediately, consider deploying EDR rules that alert on or block non-browser processes making HTTP requests to Ray dashboard ports with non-Mozilla User-Agent strings. This is a compensating control, not a fix.

P3 — Within 7 days

  1. Audit Ray usage in CI/CD and ML pipelines. Ensure Ray images in container registries, Helm charts, and infrastructure-as-code templates pin version >=2.52.0.
  2. Developer awareness. Notify developers running Ray locally of the drive-by risk via browser and the requirement to upgrade. Advise use of separate browser profiles or containers for development work accessing untrusted web content.
  3. Review BitSight Rondodox reference. Assess whether the referenced BitSight blog (https://www.bitsight.com/blog/rondodox-botnet-infrastructure-analysis) contains IOCs relevant to your environment. The relationship between this blog and CVE-2025-62593 is not established in the provided source material.

5. Indicators of compromise

No indicators of compromise available in the source material.

Behavioural indicators

Behaviour Where to observe Confidence
HTTP requests to Ray dashboard/API (default port 8265) with User-Agent header NOT starting with "Mozilla" Ray dashboard logs, network firewall logs, EDR network telemetry on developer workstations High — this is the confirmed bypass mechanism
DNS rebinding pattern: a domain that resolves first to a public IP, then re-resolves to 127.0.0.1 or a private network address within a short TTL window DNS resolver logs, network security monitoring Medium — consistent with the described attack chain but not independently observed in source material
Outbound HTTP/HTTPS connections from Ray dashboard port (8265) on developer workstations EDR, host firewall logs Low — inferred from attack chain, not explicitly described in source

6. Detection

Insufficient indicators to author detection rules.

The source material describes the vulnerability mechanism (User-Agent bypass + DNS rebinding) but does not provide specific malicious file artefacts, command-line strings, mutex names, registry keys, or hard-coded values that would constitute threat artefacts for YARA or Sigma rules. The behavioural indicators in §5 describe the vulnerability's exploitation pattern but not a specific threat actor's tooling or malware.

CVE assessment

1 referenced CVE — 1 critical (CVSS ≥ 9.0)

CVE CVSS Exploited EPSS Summary
CVE-2025-62593 9.4 Critical — 0% Ray is an AI compute engine. Prior to version 2.52.0, developers working with Ray as a development tool can be exploited via a…

7. Sources

  • NVD, "CVE-2025-62593 Detail," https://nvd.nist.gov/vuln/detail/CVE-2025-62593, published 2026-08-17 (CVE record originally received 2025-11-26).
  • CISA-ADP, SSVC assessment for CVE-2025-62593 (added to NVD record 2026-06-17), exploitation: "poc", automatable: "no", technical impact: "total".
  • BitSight, "Rondodox Botnet Infrastructure Analysis," https://www.bitsight.com/blog/rondodox-botnet-infrastructure-analysis (URL added to CVE record by CISA-ADP 2026-08-17; relationship to CVE not detailed in provided material).

8. Adverse Trace position

CVE-2025-62593 is a legitimately critical vulnerability (CVSS 9.4) with a confirmed proof-of-concept and a straightforward exploitation path against developer workstations running Ray. The attack requires user interaction (visiting a malicious page) but no privileges and has total technical impact. For EMEA financial services firms, the primary risk is to AI/ML development environments where Ray is increasingly adopted for distributed model training — a compromised developer workstation can serve as a pivot point into broader corporate and production networks. The vulnerability is NOT in CISA KEV and EPSS is at 0%, which may understate the practical risk given the confirmed PoC and the low barrier to exploitation via malvertising. The BitSight/Rondodox reference added by CISA-ADP is unexplained in the available source material and should be treated as a lead requiring further investigation, not as confirmed exploitation attribution. We will monitor for KEV addition, updated EPSS scoring, and further detail on the Rondodox connection, and will issue an update if exploitation is confirmed in the wild.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.

Post this to LinkedIn
Formatting is converted automatically — headings, bullets, a link back & hashtags. Paste straight in.
J
Jeff Davies