On August 17, 2026, CISA placed CVE-2025-62593 in the agency’s KEV catalog. The entry raises the priority of a Ray flaw first disclosed on November 26, 2025: a hostile page opened in Firefox or Safari can reach an unpatched Ray development service and execute shell code on the host. Covered federal agencies received an August 20 remediation due date.
The Ray project advisory identifies every release below 2.52.0 as affected. The demonstrated attack combines DNS rebinding with a browser-set User-Agent header, then submits a job to an unauthenticated Ray dashboard. Ray 2.52.0 is the first fixed release and supersedes every earlier Ray version for this flaw.
Ray trusted a browser header
Ray exposes dashboard and job-submission functions during local development. Its browser defense classified a request as browser traffic when the User-Agent value began with Mozilla, then rejected browser POST and PUT requests. The source comment called that heuristic “very weak” while assuming browser fetch calls could not alter the header.
Firefox and Safari break that assumption. The advisory found that their Fetch implementations allow JavaScript to set another User-Agent value. A hostile page can therefore send a request that looks non-browser to Ray’s middleware. Chrome did not permit the same header change when the advisory was published, so the demonstrated path did not work there.
The header bypass becomes code execution because sensitive Ray endpoints lack authentication in affected configurations. The advisory names /api/jobs and /api/job_agent/jobs/; its demonstration sends a POST to /api/jobs/ on the dashboard’s default port, 8265, with User-Agent: Other. The request supplies a shell command as the Ray job entry point.
DNS rebinding crosses localhost
The hostile page still needs browser access to the Ray service. DNS rebinding supplies that bridge. The browser first resolves an attacker-controlled hostname to the attacker’s web server and loads the page. A later lookup returns a loopback or private-network address for the same hostname. The page retains its web origin while the browser directs its requests to the Ray dashboard.
Figure details
The diagram shows two points in the DNS-rebinding sequence. At time one, an attacker-controlled hostname resolves to the public web server and Firefox or Safari loads the hostile page. At time two, the same hostname resolves to a local Ray service. The browser sends a POST request to /api/jobs/ on port 8265 with User-Agent set to Other; an unpatched Ray dashboard accepts the job and executes its shell entry point.
That sequence also reaches beyond localhost when the developer’s browser can route to a Ray node on a corporate network. The advisory describes the browser as a confused deputy: the attacker cannot directly reach the private service, while the user’s browser can.
The published demonstration made the consequence deliberately visible. After rebinding succeeded, the job tried platform-specific calculator commands and printed the marker RAY RCE: By JLLeitschuh with a timestamp. The proof used these observable values:
- dashboard TCP port
8265 POST /api/jobs/User-Agent: Other- job metadata source
nccgroup/singluarity - Windows command
calc.exe - macOS command
open -a Calculator - macOS path
/System/Applications/Calculator.app/Contents/MacOS/Calculator - Linux commands
gnome-calculator,kcalc, andxcalc - marker prefix
RAY RCE: By JLLeitschuh
These are proof-of-concept traces, rather than indicators CISA attributes to exploitation in the wild. Staged browser requests can be visible without a successful Ray job, and a submitted job can exist without evidence that its entry point executed. Preserve the dashboard request, job record, process telemetry, and child process before assigning the outcome.
CISA confirms known exploitation
CISA’s KEV entry establishes known exploitation, but its public record does not identify victims, operators, a campaign, or the exploit path observed. It lists known ransomware campaign use as Unknown. The Ray advisory demonstrates the Firefox and Safari path; the two sources do not establish that every observed attack used it.
Neither source quantifies exposed Ray installations, exploitation events, or compromised hosts. The affected environment is narrower than every Ray deployment: the browser path requires attacker-controlled content, Firefox or Safari, browser reachability to a Ray dashboard, and a release below 2.52.0. Those prerequisites constrain exposure without reducing the consequence after a successful Jobs API request.
Browser-side local-network protections may stop some attempts. The Ray advisory warns that earlier browser protections have been rolled back and treats browser hardening as defense in depth. Ray 2.52.0 also added token authentication as optional hardening, disabled by default. A patched package and explicitly enabled authentication provide separate controls.
Upgrade and test the boundary
Inventory developer workstations, notebooks, build hosts, and private compute nodes that import Ray. Record both the package version and whether the dashboard listens on port 8265 beyond an intended management boundary. Restrict dashboard access to trusted administration paths, and enable Ray token authentication according to the project’s guidance after testing client compatibility.
Search retained dashboard or reverse-proxy logs for POST requests to /api/jobs/ and /api/job_agent/jobs/, especially an unusual User-Agent value following a visit to an untrusted page. Correlate accepted jobs with Ray job metadata, shell creation, calculator processes, and the proof marker. Absence of the published strings does not clear a host because CISA has not described the in-the-wild tooling.
Verify the package directly on every in-scope Python environment:
python -c 'import ray; print(ray.__version__)'The expected result is 2.52.0 or a later version. Then confirm the service inventory shows no unintended listener on port 8265, or that every intended listener sits behind the approved network boundary and required authentication. That combined result removes the published vulnerable version and tests the access condition the browser attack needs.