Ray is an AI compute engine.

CVE-2025-62593 is a remote code execution flaw in Anyscale Ray (all versions prior to 2.52.0) that chains a DNS rebinding attack with a User-Agent header guard bypass on the unauthenticated Ray Dashboard API (/api/jobs/ and /api/job_agent/jobs/). Ray's only browser-side protection was checking that the User-Agent header starts with "Mozilla" — a check the Fetch API in Firefox and Safari allows an attacker to trivially override. When a developer running Ray locally visits a malicious page (or is served a malvertisement), the attacker's JavaScript rebinds their domain to 127.0.0.1:8265, sets a custom User-Agent, and POSTs a job submission payload containing an arbitrary shell command. The developer's machine executes it without any authentication prompt. Chrome happens to be unaffected due to an implementation quirk, not by design.

The GHSA advisory assigned a CVSS 4.0 score of 9.4 CRITICAL, but no official vendor (Anyscale) CVSS baseline exists. A 9.4 overstates the real-world risk for most enterprise environments because the chain requires a specific browser family, active user interaction (visiting a malicious site), and successful DNS rebinding — all friction points that modern browser security features increasingly mitigate. However, the KEV listing is not decorative: the broader Ray ecosystem has been hammered by the ShadowRay 2.0 campaign (exploiting CVE-2023-48022), and this CVE extends that attack surface to developer workstations that are otherwise unreachable. The real danger is the *pivot*: a compromised ML engineer's laptop typically holds SSH keys, cloud tokens, and credentials to production Ray clusters and GPU infrastructure. HIGH is the correct bucket — not CRITICAL, because the attack prerequisites are narrow; not MEDIUM, because the blast radius on success is devastating.

Why this verdict

• KEV floor: CISA KEV listing confirms in-the-wild exploitation. The broader ShadowRay 2.0 campaign demonstrates that threat actors are actively targeting Ray infrastructure at scale — this CVE extends that threat to developer workstations previously considered unreachable.
• Role multiplier: Ray is deployed on (a) developer workstations running local clusters, (b) production AI/ML compute clusters, and (c) high-value GPU infrastructure holding proprietary models, training data, and cloud credentials. This CVE targets role (a), but a compromised developer machine is a direct pivot to roles (b) and (c). The blast radius is host → cloud-infrastructure → fleet. Because ≥10% of Ray installations are developer workstations with production credentials, the verdict floor is HIGH.
• Browser friction limits CRITICAL: Only Firefox and Safari are affected (~30-35% combined desktop share). Chrome (~65%) is immune due to an implementation quirk. Enterprise browser policies often mandate Chrome/Edge, further narrowing the vulnerable population. This friction prevents escalation to CRITICAL.
• DNS rebinding friction: Modern browser versions increasingly implement Private Network Access (PNA) checks that block requests from public origins to loopback addresses. Firefox 130+ and Safari 18+ have partial PNA support. Corporate DNS resolvers with longer cache TTLs also degrade rebinding reliability.
• No authentication by design: Ray's Dashboard API has historically had zero authentication. Even the 2.52.0 fix adds token auth as *opt-in, disabled by default*. This means patching alone doesn't fully remediate — defenders must also enable auth.

Why not higher?

CRITICAL would require the attack to be reliably exploitable across all browsers and without user interaction. This CVE requires the victim to use Firefox or Safari (~35% of desktop users), visit a malicious page, and have DNS rebinding succeed — three compounding friction points that materially reduce the exploitable population. Chrome's immunity alone eliminates the majority of potential targets in enterprise environments that standardize on Chromium-based browsers.

Why not lower?

MEDIUM is ruled out by the KEV listing (active exploitation confirmation), the public PoC with a fully documented attack chain, and the high-value role multiplier. A compromised ML engineer's workstation is not an isolated incident — it is a beachhead into production AI infrastructure, cloud accounts, and proprietary intellectual property. The ShadowRay campaign lineage demonstrates that threat actors have the motivation, tooling, and operational playbook to exploit Ray at scale.

1. Enable Ray token-based authentication immediately — Even after patching to 2.52.0, authentication is disabled by default. Enable the new RAY_TOKEN environment variable or --token flag on all Ray head nodes. This blocks unauthenticated job submission regardless of the DNS rebinding vector. Deploy within the noisgate mitigation SLA of 30 days for HIGH, but given KEV listing, target hours.
2. Enforce Chrome/Edge via enterprise browser policy — Chrome is immune to this CVE due to blocking User-Agent header modification in Fetch. Push GPO/MDM policy restricting Firefox and Safari on developer workstations that run Ray. This eliminates the attack surface for the majority of the fleet immediately.
3. Block DNS rebinding at the corporate resolver — Configure internal DNS resolvers to reject external domain responses that resolve to RFC1918 or loopback addresses (DNS rebinding protection). Tools like dnsmasq --stop-dns-rebind or Cloudflare Gateway DNS policies can enforce this network-wide.
4. Bind Ray Dashboard to localhost with firewall rules — Ensure Ray Dashboard (port 8265) is bound to 127.0.0.1 and not 0.0.0.0. While this CVE exploits localhost access via the browser, adding host-firewall rules to block non-loopback traffic to 8265 prevents the separate direct-exposure attack path (ShadowRay 2.0).
5. Rotate developer cloud credentials and SSH keys — Given active exploitation campaigns, assume developer machines may already be compromised. Rotate AWS/GCP/Azure credentials, SSH keys, kubeconfig tokens, and Anyscale API keys for any ML engineer who has run Ray < 2.52.0. Prioritize within the KEV override window (hours).

Run this script on any host where Ray may be installed (developer workstations, ML nodes). No special privileges required. Invoke with: bash check_cve_2025_62593.sh

#!/usr/bin/env bash
# CVE-2025-62593 Checker — Ray DNS Rebinding RCE
# Checks installed Ray version against patched version 2.52.0
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

PATCHED_VERSION="2.52.0"

# Try to get Ray version
if command -v ray &>/dev/null; then
  RAY_VERSION=$(ray --version 2>/dev/null | grep -oP '\d+\.\d+\.\d+' | head -1)
elif python3 -c 'import ray' &>/dev/null; then
  RAY_VERSION=$(python3 -c 'import ray; print(ray.__version__)' 2>/dev/null)
elif python -c 'import ray' &>/dev/null; then
  RAY_VERSION=$(python -c 'import ray; print(ray.__version__)' 2>/dev/null)
else
  echo "UNKNOWN — Ray is not installed on this host."
  exit 2
fi

if [ -z "$RAY_VERSION" ]; then
  echo "UNKNOWN — Could not determine Ray version."
  exit 2
fi

echo "Detected Ray version: $RAY_VERSION"
echo "Patched version: >= $PATCHED_VERSION"

# Version comparison using sort -V
LOWER=$(printf '%s\n%s' "$RAY_VERSION" "$PATCHED_VERSION" | sort -V | head -1)

if [ "$RAY_VERSION" = "$PATCHED_VERSION" ] || [ "$LOWER" = "$PATCHED_VERSION" ]; then
  # Also check if auth is enabled
  if ray status &>/dev/null 2>&1; then
    if env | grep -q 'RAY_TOKEN'; then
      echo "PATCHED — Ray $RAY_VERSION with token auth enabled."
    else
      echo "PATCHED — Ray $RAY_VERSION installed, but token auth may not be enabled. Enable RAY_TOKEN for defense-in-depth."
    fi
  else
    echo "PATCHED — Ray $RAY_VERSION (not currently running)."
  fi
  exit 0
else
  echo "VULNERABLE — Ray $RAY_VERSION is below $PATCHED_VERSION. CVE-2025-62593 applies."
  echo "ACTION: Upgrade to Ray >= $PATCHED_VERSION and enable token authentication."
  exit 1
fi

Sources

1. GitHub Security Advisory GHSA-q279-jhrf-cc6v
2. GitHub Advisory Database — CVE-2025-62593
3. Oligo Security — ShadowRay 2.0 Campaign Analysis
4. The Hacker News — ShadowRay 2.0 Coverage
5. NVD — CVE-2025-62593 Detail
6. Vulmon — CVE-2025-62593
7. Echelon Shadow AI Radar — Live Exposed AI Infrastructure
8. Dark Reading — ShadowRay 2.0 AI Clusters