Author: Vulnerability Research & Threat Intelligence Team | digitalspying.com
Published: August 19, 2026
Category: AI Security / Vulnerability Research / Federal Directives / Cloud Compute
Executive Summary
On August 18, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added a critical, actively exploited vulnerability impacting the Ray open-source distributed computing framework to its Known Exploited Vulnerabilities (KEV) catalog. Tracked as CVE-2025-62593 with a CVSS v3.1 base score of 9.4, the flaw enables unauthenticated remote code execution (RCE) via web browsers using DNS rebinding attack techniques.
In a rare operational move demonstrating the acute severity of ongoing exploitation campaigns, CISA established a strict three-day remediation deadline (due August 21, 2026) for Federal Civilian Executive Branch (FCEB) agencies under Binding Operational Directive (BOD) 26-04, rather than the standard multi-week grace period. Ray, a Python-native framework maintained by the Ray-Project with over 43,500 GitHub stars, serves as the computational backbone for massive artificial intelligence, machine learning, and LLM training workloads across commercial enterprises and research institutions globally.
Deep-Dive Technical Analysis
1. The Vulnerability Mechanics of CVE-2025-62593
Ray provides distributed computing capabilities across clusters of compute nodes, exposing internal REST APIs and an integrated web dashboard (typically on port 8265) to monitor node performance, task scheduling, and actor job states.
* Absence of Default Host Header Validation & Authentication: Historically, Ray’s dashboard and job submission APIs operated without mandatory authentication or strict HTTP Host header validation, assuming deployment exclusively within trusted, isolated internal subnets.
* DNS Rebinding Attack Vector: An external attacker lures a data scientist or machine learning engineer to visit an attacker-controlled website using standard web browsers (such as Mozilla Firefox or Apple Safari). The malicious page leverages DNS rebinding techniques to bypass the browser's Same-Origin Policy (SOP):
1. The victim's browser initiates a connection to the attacker's domain, which initially resolves with a low Time-to-Live (TTL) to the attacker's IP.
2. The server subsequently alters the DNS mapping to point to 127.0.0.1 or the local subnet IP of the victim's Ray cluster.
3. Client-side JavaScript running in the victim's browser then transmits HTTP POST requests directly to the local Ray dashboard API endpoint.
* Unrestricted Code Injection & Execution: Because the Ray API accepts arbitrary Python task definitions and job submissions, the incoming browser requests trigger immediate execution of arbitrary system commands and shellcode on the host node, running with the privileges of the active Ray worker process.
Vulnerability Attribute
Details
Vulnerability Identifier
CVE-2025-62593
Affected Software
Ray Distributed Computing Framework (Ray-Project)
Vulnerability Class
Code Injection / Insecure API Exposure (CWE-94 / CWE-352)
CVSS v3.1 Base Score
9.4 (Critical)
Attack Vector
Network / Browser-Based DNS Rebinding (Zero Authentication)
CISA KEV Addition Date
August 18, 2026
Federal Remediation Deadline
August 21, 2026 (3-Day Emergency Mandate)
2. Active Threat Exploitation and Shadow AI Deployments
Threat intelligence telemetry confirms that threat actors have actively weaponized CVE-2025-62593 across multiple threat clusters:
* Cloud Metadata & API Secret Harvesting: Attackers executing code within Ray worker nodes query cloud provider Instance Metadata Services (IMDS) to steal AWS IAM credentials, GCP service account keys, and Hugging Face API tokens.
* Cryptojacking & Resource Hijacking: Compromised GPU-accelerated Ray clusters are hijacked to execute cryptocurrency mining operations (such as XMRig for Monero), consuming high-cost enterprise compute quotas.
* Shadow AI Visibility Gaps: Because Ray clusters are frequently provisioned directly by data science and engineering teams outside standard IT and DevOps change-management workflows, many organizations maintain public-facing or under-protected Ray deployments without central security visibility.
Industry Impact & Federal Urgency
CISA's enforcement of a three-day remediation directive signals that exploitation is widespread and consequences are severe. A compromised Ray cluster provides threat actors with total access to proprietary model architectures, internal training datasets, customer data, and downstream production inference pipelines.
Strategic Recommendations and Mitigations
Enterprise security leaders, data engineers, and AI infrastructure teams must execute immediate remediation steps:
1. Conduct Immediate Shadow AI Asset Discovery: Audit cloud VPCs and internal networks for exposed Ray dashboards (TCP port 8265) and Ray cluster endpoints (TCP port 10001+).
2. Upgrade Ray to Patched Versions: Immediately upgrade Ray installations to version 2.40.0 or higher, which enforces strict HTTP Host header validation and blocks DNS rebinding.
3. Enforce Network Isolation and Reverse Proxy Authentication: Never expose Ray dashboard or job submission ports directly to the public internet or untrusted corporate VLANs. Place Ray clusters behind VPNs, bastions, or authenticated reverse proxies (such as OAuth2-Proxy / Cloudflare Access).
4. Implement Container and IAM Least Privilege: Run Ray worker nodes in isolated container sandboxes with non-root user permissions, and enforce AWS IMDSv2 with a hop limit of 1 to block metadata exfiltration.
5. Rotate Exposed Secrets and Tokens: Inspect cluster environment variables and rotate any cloud credentials, database connection strings, or Hugging Face tokens accessible to worker nodes.