Advisory · CVE-2025-62593
Your browser can be tricked into owning your Ray cluster
Ray's browser-based request protection relies on a User-Agent check that Firefox and Safari can bypass, and combined with DNS rebinding it lets a malicious website execute code on a developer's Ray instance.
- Vendor
- Ray-Project
- Product
- Ray
- Identifier / CWE
- CVE-2025-62593
CWE-94 - Action timing
- Sep 7, 2026
Explain it like I’m five
Ray's bouncer only lets in people wearing a specific hat that says Mozilla, and Firefox and Safari let anyone borrow that hat. A stranger on a website puts on the hat, swaps the address on the door, and walks into your workshop to use your tools.
- 01Malicious page visited
A developer running a vulnerable Ray instance visits a malicious website or is served a malicious ad in Firefox or Safari.
- 02User-Agent spoofed
The page's script modifies the User-Agent header via the Fetch API, satisfying Ray's check that it starts with Mozilla.
- 03DNS rebinding
The attacker's domain first resolves externally, then re-resolves to the Ray server's address, so the browser treats requests to Ray as same-origin.
- 04Code executed
The browser forwards requests to Ray's unauthenticated critical endpoints such as /api/jobs, executing arbitrary code.
What happened
On August 17, 2026, CISA added CVE-2025-62593 to the Known Exploited Vulnerabilities catalog, citing active exploitation of a code injection flaw in Ray. It is rated critical at CVSS 9.4 under CVSS v4.0 and was first disclosed by Ray maintainers in November 2025.
Ray’s protection against browser-based attacks relied on checking that the HTTP User-Agent header begins with the string “Mozilla”. That defense is insufficient because the Fetch specification allows Firefox and Safari to modify the User-Agent header. Combined with a DNS rebinding attack, a developer running Ray who visits a malicious website or is served a malicious advertisement can have arbitrary shell code executed on their machine: the attacker’s domain initially resolves externally and then re-resolves to the Ray server, so the browser treats requests to Ray’s dashboard as same-origin and forwards them to critical endpoints like /api/jobs that carry no authentication of their own.
The issue is fixed in Ray 2.52.0. Ray credited Oligo researcher Avi Lumelsky for the Fetch bypass discovery and Jonathan Leitschuh for the DNS rebinding technique. The exploitation window is real: reporting describes the RondoDox DDoS botnet incorporating the flaw into its arsenal and a campaign dubbed ShadowRay 2.0 turning compromised GPU clusters into a self-replicating cryptomining botnet. CISA gave federal agencies three days to remediate.
What to do
- Upgrade Ray to 2.52.0 or later on every developer machine and cluster, including test and research environments that tend to be forgotten.
- Until patched, avoid visiting untrusted websites and block malvertising exposure on machines running Ray, since the attack is triggered by the victim’s browser.
- Treat developer workstations and private-network Ray instances as in scope: the browser can act as a confused deputy to reach Ray instances inside the corporate network.
- Review Ray job histories and host logs for unexpected job submissions or processes that do not match legitimate workloads.
- Confirm the running Ray version after the upgrade.
Management note
This is the rare vulnerability where the exploit runs through your engineers’ browsers while they do their jobs. Ray is the compute engine behind AI workloads, often on expensive GPU hardware, and attackers are already converting compromised clusters into mining botnets. The patch is a version bump, but the harder work is finding every developer laptop and lab cluster running an old Ray, because those are the ones nobody inventories.