Ray RCE exploited in the wild (CVE-2025-62593)

Actively exploited in the wild - CVE-2025-62593 is a critical remote code execution vulnerability in Ray AI compute engine versions prior to 2.52.0 that lets attackers execute arbitrary code on a developer’s machine by combining DNS rebinding with a browser-based attack. Patched in version 2.52.0 - update immediately.

Overview

Ray is an open-source AI compute engine widely used by developers for distributed Python applications and machine learning workloads. The vulnerability exists in Ray’s insufficient defense against browser-based attacks. Ray checks the User-Agent header for a string starting with “Mozilla” to distinguish legitimate browser traffic, but the fetch specification allows attackers to modify this header, defeating the protection.

An attacker exploits this by tricking a developer into visiting a malicious website or clicking a malicious advertisement. Through DNS rebinding, the attacker’s domain resolves to the developer’s local Ray instance, allowing the malicious site to send crafted requests directly to Ray’s internal services. This bypasses the browser’s same-origin policy and gives the attacker unauthenticated access to Ray’s dashboard and API endpoints, enabling remote code execution on the host machine.

Impact

Successful exploitation grants an attacker full remote code execution on the developer’s machine. This means the attacker can steal source code, credentials, and other sensitive data, install malware, or pivot to other systems on the network. The attack requires only passive user interaction - the developer simply visiting a compromised page. With a CVSS score of 9.4 and confirmed active exploitation noted by CISA’s Known Exploited Vulnerabilities catalog, this is a serious threat to any organization using Ray for development.

The attack vector is particularly insidious because many developers run Ray locally on their workstations, treating it as a trusted development tool rather than a network-exposed service.

Remediation

Update Ray to version 2.52.0 or later immediately. This is the only complete fix for this vulnerability.

For organizations that cannot patch immediately:

• Restrict access to Ray’s dashboard and API ports (default 8265) using firewall rules or bind Ray to localhost only.
• Segment development environments from production networks.
• Educate developers about the risk of visiting untrusted websites while Ray is running.
• Monitor for unusual network connections to Ray service ports.

Given the low EPSS score of 0.4%, mass exploitation is not imminent, but the confirmed active exploitation means targeted attacks are already occurring. Prioritize patching for developers who work with sensitive code or have access to production infrastructure.

Security Insight

This vulnerability highlights a growing class of attacks targeting AI development infrastructure. As AI tooling becomes central to software development, attackers are shifting focus from production servers to developer workstations, which often have elevated access and weaker security controls. Ray’s failure to properly validate browser-originated requests demonstrates that even sophisticated AI platforms need to apply web-security fundamentals. The reliance on User-Agent header checks is a pattern seen in older web vulnerabilities, suggesting that AI infrastructure teams must adopt modern security practices, including proper origin validation and DNS rebinding protections, as these tools become attack surfaces themselves. Data breach reports are available at breach reports and cybersecurity news at security news.

Further Reading

• All Critical Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs