CVE-2025-62593: Ray AI Compute Engine Browser-to-RCE via DNS Rebinding (KEV)

CVE-2025-62593 is a code-injection flaw in Ray, the open-source AI compute engine: Ray's dashboard trusts the User-Agent header to decide whether a request came from a browser, but Firefox and Safari let a malicious web page rewrite that header, so an attacker who first uses a DNS-rebinding attack to point the victim's browser at the developer's local Ray instance can submit a job that runs arbitrary code on the developer's machine, and CISA KEV confirms this is being exploited.

CVE-2025-62593 is a Code Injection (CWE-94) vulnerability in Ray, the open-source AI compute engine used to scale Python and ML workloads. NVD's Analyzed description states: "developers working with Ray as a development tool can be exploited via a critical RCE vulnerability exploitable via Firefox and Safari. This vulnerability is due to an insufficient guard against browser-based attacks, as the current defense uses the User-Agent header starting with the string 'Mozilla' as a defense mechanism. This defense is insufficient as the fetch specification allows the User-Agent header to be modified" (NVD).

NVD published an independent Primary score of CVSS v3.1 8.8 (high), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (NVD). The Ray-Project CNA's own GitHub advisory additionally scores it under CVSS v4.0 at 9.4 (critical), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H — a CNA Secondary rating, not NVD's own figure, but consistent in severity with NVD's v3.1 score (Ray-Project GitHub Advisory GHSA-q279-jhrf-cc6v).

The GitHub advisory explains the full chain: Ray's dashboard API (reachable on localhost, typically port 8265) only checks that an incoming request's User-Agent header starts with "Mozilla" to reject non-browser clients. Chrome blocks scripts from overriding the User-Agent header via fetch(), but Firefox and Safari do not. An attacker combines that gap with a DNS-rebinding attack (for example using the nccgroup/singularity tooling) so that a domain the victim's browser has already resolved gets re-pointed to localhost or an internal address; once the browser's same-origin check is satisfied, a page the victim merely visits (or is served as a malicious ad) can POST a crafted job to Ray's /api/jobs/ endpoint with a spoofed User-Agent and have Ray execute it, demonstrated cross-platform by launching a calculator app on Windows, macOS and Linux (Ray-Project GitHub Advisory GHSA-q279-jhrf-cc6v). The issue is fixed in Ray 2.52.0.

CISA added CVE-2025-62593 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-08-17 (catalog version 2026.10.28, 1762 entries, confirmed live this run), with forensic-triage required under BOD 26-04 and a required-action due date of 2026-08-20; the catalog's own description matches: "Developers using Ray as a development tool may be exposed to this vulnerability exploitable through Firefox and Safari" (CISA KEV). A BitSight writeup cited in NVD's references ties internet-facing, unpatched Ray dashboards to the "RondoDox" botnet's scanning and exploitation activity against exposed AI infrastructure, rather than a targeted browser-based campaign specifically (BitSight: RondoDox botnet infrastructure analysis).

As of 2026-10-28, FIRST scores the probability of exploitation at 0.6015 (99.132th percentile), a high score consistent with both the KEV listing and the fact that unauthenticated Ray dashboards are directly scannable regardless of the browser-rebinding vector (FIRST EPSS).

Any developer or team running Ray before 2.52.0 should upgrade immediately; because the dashboard is meant for localhost/internal use, it should never be exposed to the public internet, and upgrading remains the only complete fix for the browser-rebinding vector itself.

• Ray before 2.52.0 trusts a User-Agent header starting with "Mozilla" to distinguish browser traffic; Firefox and Safari allow that header to be rewritten via fetch(), enabling exploitation via DNS rebinding. — NVD
• NVD Primary CVSS v3.1 base score is 8.8 (high), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H; Ray-Project's own GHSA advisory separately scores it CVSS v4.0 9.4 (CNA Secondary, not NVD's figure). — NVD
• Attack chain: DNS rebinding points the victim's browser at the local Ray dashboard (port 8265); a spoofed User-Agent bypasses the Mozilla-prefix check; a crafted POST to /api/jobs/ runs arbitrary shell commands. Fixed in 2.52.0. — Ray-Project GitHub Advisory GHSA-q279-jhrf-cc6v
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-08-17 (catalog version 2026.10.28, 1762 entries), forensic-triage required under BOD 26-04, required-action due date 2026-08-20. — CISA KEV
• EPSS score is 0.6015 (99.132th percentile) as of 2026-10-28. — FIRST EPSS