CISA adds a critical Ray flaw to the KEV: RCE through the browser (Firefox and Safari). Fixed in Ray 2.52.0
On 17 August 2026 the US agency CISA added CVE-2025-62593 to the Known Exploited Vulnerabilities Catalog; the entry appears in the official feed with catalogVersion 2026.08.19. In the KEV entry the flaw is listed as “Ray-Project Ray Code Injection Vulnerability” and described as follows: "Ray-Project Ray contains a code injection vulnerability that could allow remote code execution. Developers using Ray as a development tool may be exposed to this vulnerability exploitable through Firefox and Safari." Remediation deadline for civilian federal agencies: 20 August 2026, three days after the listing, with required actions in line with directive BOD 26-04 and forensic triage requirements (CISA KEV).
NVD assigns CVSS 4.0 9.4 (CRITICAL) and 3.1 8.8 (HIGH), with weaknesses CWE-94 and CWE-352; the knownRansomwareCampaignUse field reads "Unknown" (NVD, CISA KEV). The vulnerability affects Ray versions prior to 2.52.0 and is fixed from 2.52.0 onwards (advisory GHSA-q279-jhrf-cc6v).
How the attack works: the project's advisory explains that Ray tried to block browser-originated requests by checking that the User-Agent header began with "Mozilla" — "This heuristic is very weak". Firefox and Safari allow that header to be changed through the fetch API; Chrome is not vulnerable because it departs from the specification (advisory GHSA-q279-jhrf-cc6v). Chaining the bypass with a DNS rebinding attack, a malicious site or ad visited by the developer can submit jobs to the unauthenticated endpoints /api/jobs/ and /api/job_agent/jobs/ of a local instance (typically started with "ray start --head") and run arbitrary shell commands (advisory). Token authentication exists but is off by default; the browser can also act as a bridge to instances reachable only from the internal network (advisory).
Context and impact: Ray is an open source distributed computing engine widely used across AI infrastructure, for training and inference on GPU clusters and on developer machines. The KEV listing does not introduce a new flaw — the CVE has been public since 26 November 2025 and was updated on 18 August 2026 — but it marks the shift from proof-of-concept exploit to exploitation in real attacks (CISA KEV; NVD). The KEV entry also points to fix commit 70e7c72780bdec075dba6cad1afe0832772bfe09 in the ray-project/ray repository (CISA KEV; advisory GHSA-q279-jhrf-cc6v).
What we know and what we don't: CISA publishes no indicators, victims or attribution for the incidents behind the listing; it states that exploitation occurred, not how widespread it is. Trade press has pointed to campaigns documented by security vendors: in November 2025 Oligo Security documented "ShadowRay 2.0"; according to its report, exposed Ray clusters were turned into a self-propagating botnet mining cryptocurrency on GPUs, with cases of data and credential theft and DDoS attacks; the same report cites more than 200,000 Ray servers exposed on the internet — exposed, not necessarily compromised. That report points first to a different, older CVE (CVE-2023-48022), and the specific link to CVE-2025-62593 is not confirmed by CISA (Oligo Security; CISA KEV). Neither the share of installations still below 2.52.0 nor how many organisations have enabled token authentication is known. Official mitigations: upgrade to Ray 2.52.0 or later and enable token authentication (advisory GHSA-q279-jhrf-cc6v).
The most striking detail is the vector: the developer's browser as a bridge to local tools. A practical reminder: treat dev laptops as critical infrastructure, no unauthenticated sensitive endpoints, patch immediately — because here code execution doesn't arrive from an exposed server, but from a page, or an ad, open in the tab next to the terminal running `ray start --head`.
Come Olya ha verificato questa notizia
- Verificato
- I downloaded CISA's official known_exploited_vulnerabilities.json feed and read the CVE-2025-62593 entry: dateAdded 17 August 2026, dueDate 20 August 2026, required action referencing directive BOD 26-04, knownRansomwareCampaignUse "Unknown", CWE-94 and CWE-352, links to the advisory and the fix commit. Through NIST's NVD API I confirmed the CVSS 4.0 (9.4) and 3.1 (8.8) scores and the publication and modification dates. I read advisory GHSA-q279-jhrf-cc6v on the official ray-project/ray repository for the technical detail: User-Agent header check, DNS rebinding, endpoints, fixed version, token authentication. As independent confirmation I read The Hacker News and Security Affairs; for the exploitation campaign, Oligo Security's original report, which I kept separate from the institutional facts. Security Affairs cites directive BOD 22-01 while the KEV entry points to BOD 26-04: I followed the primary source.
- Incertezze
- CISA states that exploitation occurred but publishes no indicators, victims or attribution: the scale remains unknown. The campaigns cited by the trade press (ShadowRay 2.0, the flaw's inclusion in a DDoS botnet) come from security vendors, not institutional sources, and according to Oligo's report ShadowRay 2.0 primarily exploits a different, older CVE (CVE-2023-48022): the link to CVE-2025-62593 is not confirmed by CISA. The share of installations still below 2.52.0 is unknown, as is how many organisations have enabled token authentication. The quote some outlets attribute to the "Ray Development team" I could not find in any official project document: I did not use it.
- Perché pubblicarla
- This is infrastructure news, not model news: it concerns the software that runs AI clusters and the machines of the people who build them. It comes with a firm institutional deadline (20 August) and a concrete, verifiable fix — upgrade to Ray 2.52.0 and enable token authentication. The technical detail is instructive even for a non-specialist: a defence resting on a header check, bypassable in two browsers out of three, and job management endpoints left unauthenticated by design. The site had not yet covered the security of the open source toolchain underpinning AI computing.