Executive Summary
On August 17–19, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2025-62593 (CVSS 9.4, Critical) to its Known Exploited Vulnerabilities (KEV) catalog, mandating immediate remediation for federal agencies and enterprise AI teams. CVE-2025-62593 is a critical unauthenticated remote code execution (RCE) and code injection vulnerability impacting Ray, the widely deployed open-source distributed computing framework maintained by Anyscale for scaling artificial intelligence, machine learning, and Python workloads across GPU/CPU clusters. Notably, the vulnerability is reachable through standard web browsers (including Firefox and Safari) via DNS rebinding without requiring direct external network exposure to the Ray cluster, enabling attackers to compromise developer workstations, hijack model training infrastructure, and recruit nodes into botnets like RondoDox.
Deep-Dive Technical Analysis
Attack Vector and DNS Rebinding Mechanics
Ray's internal dashboard and HTTP API endpoints manage distributed job submissions, task scheduling, and node coordination.
1. Flawed Security Boundary (User-Agent Reliance):
* In versions prior to 2.52.0, Ray attempted to guard against cross-origin browser-based requests by checking if the incoming HTTP User-Agent header started with the string "Mozilla".
* Because standard browser Fetch specifications allow granular header manipulation and specific cross-origin request profiles, relying on User-Agent matching proved fundamentally inadequate as an authentication or origin-validation barrier.
2. Cross-Origin DNS Rebinding Exploit Chain:
* A threat actor sets up a malicious website or serves a malformed advertisement.
* When an AI engineer or data scientist running Ray locally or connected to an internal cluster visits the page using Firefox or Safari, embedded JavaScript initiates a DNS rebinding sequence.
* The attacker's authoritative DNS server rapidly alternates the IP resolution of the attacker domain between its external server and 127.0.0.1 (or the cluster's internal RFC1918 private IP).
* Once the browser treats the local Ray API as same-origin with the malicious site, the script sends unauthenticated job-submission payloads directly to the Ray API, executing arbitrary bash/Python commands with the privileges of the Ray runtime process.
3. Active Exploitation in the Wild:
* Threat intelligence reports indicate that botnet operators (such as the RondoDox DDoS syndicate) and cryptocurrency mining campaigns rapidly incorporated CVE-2025-62593 into automated scanning kits to hijack enterprise AI compute clusters.
* The attack echoes the massive "ShadowRay" campaign, which compromised hundreds of thousands of exposed cluster nodes to harvest cloud credentials, proprietary AI training datasets, and model weights.
Industry Impact
* AI/ML Workload Hijacking: Attackers gain arbitrary execution across GPU clusters (NVIDIA H100/A100 nodes), enabling theft of proprietary model weights, training pipeline tampering, and computational hijacking for LLM training or cryptomining.
* Developer Environment Compromise: Data scientists working in local Jupyter/Ray notebooks can be compromised simply by browsing the web, creating a silent lateral-movement bridge into corporate VPCs.
* Supply Chain and Data Poisoning: Malicious jobs submitted to Ray clusters can silently inject backdoor weights or poison training data before models are deployed into production.
Mitigations & Defense Recommendations
1. Upgrade Ray Instantly:
* Upgrade all Ray deployments across developer machines, Docker containers, and Kubernetes clusters to Ray version 2.52.0 or later, which completely eliminates the flawed User-Agent origin defense and enforces strict origin and token authentication.
2. Network Segmentation & Air-Gapping:
* Isolate Ray dashboard ports (default port 8265) and worker ports behind strict firewall rules and VPNs. Never expose Ray dashboard ports to public interfaces or unsegmented developer subnets.
3. Deploy DNS Rebinding Protections:
* Configure local DNS resolvers (e.g., CoreDNS, dnsmasq) to discard responses returning private/loopback IP addresses (RFC1918 / 127.0.0.0/8) for external domain names.
4. Audit AI Cluster Secrets:
* Rotate all AWS/GCP/Azure access keys, Hugging Face tokens, and database credentials stored in environment variables across existing Ray cluster nodes to prevent credential reuse.
Security Review Completed By:
Person
Date