AI Compute Infrastructure Under Attack: CISA Adds Critical Ray RCE Flaw CVE-2025-62593 to KEV Catalog
Executive Summary
On August 17, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) issued an urgent advisory adding CVE-2025-62593 to its Known Exploited Vulnerabilities (KEV) Catalog. The critical vulnerability impacts Ray (an open-source unified compute framework maintained by Anyscale/Ray-Project), which is widely deployed across enterprise and cloud environments to scale distributed AI and machine learning workloads.
Carrying a CVSS base score of 9.4 (Critical), CVE-2025-62593 allows unauthenticated remote attackers to execute arbitrary code across Ray cluster nodes by weaponizing Cross-Site Request Forgery (CSRF) and DNS rebinding attacks against developers and ML engineers. With active in-the-wild exploitation confirmed by federal authorities and threat intelligence teams, organizations running distributed training pipelines, model fine-tuning jobs, or local Ray instances must immediately audit their environments and apply hardening controls under Binding Operational Directive (BOD) 26-04.
Deep-Dive Technical Analysis
1. Root Cause & Architectural Weakness
Ray is designed to orchestrate high-performance distributed computing tasks across GPU/CPU clusters. Central to its administration is the Ray Dashboard and API server, which allows engineers to submit jobs, monitor worker memory, and view cluster metrics.
The vulnerability stems from a dangerous convergence of two software weaknesses:
* CWE-94 (Improper Control of Generation of Code / Code Injection): Ray's internal task-submission endpoints accept and evaluate executable code constructs without enforcing strict cryptographic authorization or input validation.
* CWE-352 (Cross-Site Request Forgery - CSRF): The HTTP dashboard endpoints lacked robust origin-checking and anti-CSRF token verification on critical state-changing actions.
Historically, Ray's defense against browser-based cross-origin requests relied almost entirely on a superficial check verifying whether the incoming User-Agent HTTP header began with "Mozilla". However, modern browser fetch specifications and HTTP header manipulation techniques allow attackers to bypass this constraint.
2. The Attack Chain: DNS Rebinding + CSRF
The weaponization of CVE-2025-62593 operates via a multi-stage attack vector that specifically targets developers and data scientists running Ray instances:
1. Lure & Delivery: An attacker lures an engineer running an active Ray dashboard on their local workstation (e.g., localhost:8265) or an internal subnet to visit a malicious website or view a compromised advertisement.
2. DNS Rebinding: The malicious web page serves JavaScript that initiates communication with an attacker-controlled domain configured with a minimal Time-to-Live (TTL). Once the initial payload loads, the domain’s DNS record dynamically rebinds to 127.0.0.1 or the internal private IP address of the Ray cluster.
3. Cross-Origin Execution: Exploiting browser differences (particularly reproducible in Mozilla Firefox and Apple Safari where strict CORS enforcement and same-site cookie boundaries interact with DNS-rebound origins), the malicious script issues asynchronous POST requests to Ray's job submission API endpoints.
4. Code Injection & Execution: The Ray API server processes the rebound request as a legitimate local command, executing arbitrary Python payloads or shell binaries in the context of the Ray daemon with no authentication required.
+-------------------+ 1. Visit Lure Webpage +------------------------+
| Developer Client | -------------------------------> | Attacker Malicious Web |
|---|---|---|
+-------------------+ 2. Serve JS Payload +------------------------+
|
| 3. Rebind DNS to 127.0.0.1:8265
| 4. Issue Unauthenticated Job Submit (CWE-94 / CWE-352)
v
+---------------------------------------------------------------+
| Local / Subnet Ray Node (CVE-2025-62593 Exploit Execution) |
| -> Executes Arbitrary Python Payloads / Shell Backdoors |
| -> Lateral Movement across Distributed Worker Nodes |
+---------------------------------------------------------------+
Industry Impact & Threat Landscape
1. High-Value AI Compute Hijacking & Cryptomining
Threat actors (including cryptomining syndicates and botnets such as RondoDox) are actively scanning for vulnerable Ray instances to hijack high-end NVIDIA GPU clusters (H100, A100, RTX 4090/3080 series). By deploying stealth cryptominers, attackers convert enterprise compute budgets into illicit revenue while degrading model training performance.
2. AI Model Intellectual Property Theft
In enterprise ML environments, Ray clusters directly process proprietary foundational model weights, proprietary algorithms, financial datasets, and private healthcare records. Unauthenticated RCE allows adversaries to extract training datasets and exfiltrate proprietary model artifacts directly to remote C2 infrastructure.
3. Cloud Infrastructure Credential Harvesting
Ray worker nodes typically operate with attached IAM roles, Kubernetes service account tokens, and cloud access keys (AWS, GCP, Azure) to fetch data from object stores (S3, GCS, Blob). Compromising a single Ray node allows attackers to dump environment variables, scrape metadata services (169.254.169.254), and pivot laterally across the broader corporate cloud architecture.
Mitigation Strategies & Security Recommendations
1. Immediate Patch Deployment
Upgrade all Ray deployments to version 2.52.0 or later immediately. The patched versions introduce strict origin validation, robust CSRF protection mechanisms, and hardened API endpoint controls that reject unauthenticated cross-origin job submissions.
2. Network Isolation & Perimeter Hardening
* Zero Internet Exposure: Ensure Ray dashboard and API ports (default 8265, 10001, 6379) are strictly bound to loopback interfaces or restricted behind private corporate VPNs and bastion hosts.
* Firewall Rules: Block all direct inbound connections from untrusted networks to cluster nodes.
3. Identity & Access Management (IAM)
* Enforce mutual TLS (mTLS) or robust token-based authentication across all Ray cluster interconnects and API gateways.
* Run the Ray daemon under a dedicated, low-privileged service account with minimal filesystem and system call privileges.
* Restrict attached IAM/cloud role permissions to only the specific storage buckets necessary for task execution.
4. Forensic Auditing & Triage
Pursuant to CISA Binding Operational Directive (BOD) 26-04 guidelines:
* Inspect Ray log files (/tmp/ray/session_latest/logs/) for unexpected job submissions, unknown worker processes, or anomalous outbound network connections.
* Scan for unauthorized Python child processes spawning interactive shells (/bin/sh, /bin/bash, powershell.exe) from the Ray runtime directory.
* Verify environment variable integrity and rotate any cloud credentials that were loaded into memory on exposed Ray nodes.