CISA Adds Actively Exploited Ray Vulnerability to KEV Catalog

On Monday, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a critical vulnerability in the Ray framework to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. Ray is an open-source Python framework for distributed computing designed to scale artificial intelligence and machine learning workloads; on GitHub the project has more than 43,500 stars and over 7,900 forks.

From the browser to code execution

The CVE-2025-62593 vulnerability (CVSS score 9.4) allows remote code execution through browsers such as Firefox and Safari via a DNS rebinding attack. The root of the problem, as Ray's own maintainers acknowledge, is a longstanding decision by the team not to implement any authentication on critical endpoints such as /api/jobs and /api/job_agent/jobs/. In November 2025, the maintainers noted that this had “once again” led to a serious vulnerability, this time in a development context.

The attack works like this: a developer running Ray visits a malicious site or is served a malicious ad. Combined with User-Agent spoofing and a DNS rebinding attack, the browser is turned into a “confused deputy” through which the attacker executes arbitrary shell code on the victim's machine. What's more, the attack can be spread to neighboring Ray instances running inside a private corporate network.

Fix and exploitation

The issue has been fixed in version 2.52.0 of the Python package. Discovery of the fetch bypass is credited to Oligo researcher Avi Lumelsky, and the idea for the DNS rebinding attack to Jonathan Leitschuh.

CISA has not disclosed details of exactly how the vulnerability is being used in real-world attacks. However, according to a BitSight report from March 2026, the operators of the RondoDox DDoS botnet added it to their arsenal two days before its public disclosure on November 26, 2025 — thanks to an available proof-of-concept. According to Oligo, unpatched Ray instances are also being targeted by the ShadowRay 2.0 campaign, which turns infected clusters with NVIDIA GPUs into a self-propagating botnet for cryptocurrency mining.

In light of the active exploitation, U.S. federal civilian agencies have been ordered to apply the fixes and mitigations by August 20, 2026.

Source: The Hacker News