Ray AI framework flaw lets browsers trigger code execution

Published August 14, 2026 CVE-2025-62593

A dangerous flaw in Ray, an open-source tool that companies use to run AI and machine learning jobs across many computers, lets an attacker run their own code on a developer's machine just by getting them to visit a malicious webpage or ad. CISA confirms attackers are already using it, and a cryptomining botnet has been exploiting it since before it was even publicly disclosed.

Severity
HighCVSS 3.1 · 8.8
Fix
Fixed in 2.52.0
Affected versions
before 2.52.0
Weakness
CWE-94Code Injection
Exploit likelihood
17% in 30 daysEPSS, higher than 97% of known flaws
Affects
Ray
Exploited
Yes, in the wildListed by CISA
Added to CISA list
Aug 17, 2026
Federal fix deadline
Aug 20, 2026

How it works

  • Ray's job-management web address never requires a password, so any code running in a developer's browser can quietly send it commands.
  • Combined with a trick that fools the browser into thinking a malicious site is actually the developer's own computer, an attacker can slip commands past the browser's normal same-site protections and reach Ray directly.

What to do

Check the installed Ray version with python3 -m pip show ray and compare it against 2.52.0. Anyone running an earlier version, especially with Ray's dashboard or job API reachable, is exposed.

Run this in the application environment you want to check:

python3 -m pip show ray

Update to Ray version 2.52.0 or later using python3 -m pip install -U ray, and avoid exposing Ray's dashboard or job-control ports to the open internet or to browsers on untrusted networks in the meantime.

Technical details

CVE-2025-62593 (CVSS 9.4) affects Ray's unauthenticated /api/jobs and /api/job_agent/jobs/ endpoints. An attacker combines a User-Agent-header bypass of Ray's existing fetch protections with a DNS rebinding attack, letting a browser that visits a malicious page or ad send requests to a same-machine or network-adjacent Ray instance as if they were local, resulting in arbitrary shell code execution. Oligo's Avi Lumelsky found the fetch bypass and Jonathan Leitschuh devised the DNS rebinding chain; fixed in Ray 2.52.0. Separately, unpatched Ray clusters with NVIDIA GPUs have been hit by the ShadowRay 2.0 campaign turning them into a self-replicating cryptomining botnet, and the RondoDox DDoS botnet added this flaw before its November 26, 2025 public disclosure.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required None Attacker needs no account or login
  • User interaction Required Requires another user to take an action
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact High The service can stop or suffer serious disruption
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Open in FIRST.org calculator

References

View Original Source