CISA Puts a Critical Ray AI Flaw on Its Must-Patch List After Real World Attacks

What Happened?

The flaw, tracked as CVE-2025-62593, carries a CVSS score of 9.4. It lets an attacker run code on a developer’s machine through the web browser, of all places.

Here’s the odd part. Ray’s dashboard tried to block browser-based attacks by checking whether a request’s User-Agent header started with “Mozilla.” That was the whole defense. Trouble is, browsers let scripts rewrite that header, so the check does almost nothing. Pair that weak guard with a DNS rebinding trick, which fools the browser into treating a remote attacker’s server and a local Ray instance as the same origin, and a developer just needs to visit a booby-trapped website or load a malicious ad while Ray is running. The attack was shown to work in Firefox and Safari.

Once the request slips through, it reaches Ray’s job submission API, which historically ships without authentication. That API happily runs the attacker’s code. Ray version 2.52.0 fixes the browser flaw, and it is the version teams should be on.

What’s the Impact?

Ray sits underneath a lot of heavy compute. When a flaw like this gets weaponized, the payoff for attackers is large: developer credentials, access to training data, and a foothold into GPU-rich environments.

That payoff is already being collected. Researchers have tied exposed Ray clusters to the RondoDox DDoS botnet and to a cryptojacking campaign called ShadowRay 2.0, where attackers hijack AI infrastructure, mine cryptocurrency on stolen GPUs, and use the clusters’ own scheduling features to spread to other machines. One report counted more than 230,000 Ray servers reachable on the open internet. Many were never meant to be there. Ray’s maintainers designed it for trusted, isolated networks, but plenty of teams deploy it exposed anyway. That gap between how a tool is meant to run and how it actually runs is where attackers live.

How to Avoid This

A few practical moves, ranked by how much they buy you:

• Update Ray to 2.52.0 or later. This closes the browser-based path directly.
• Get the Ray dashboard and Jobs API off the public internet. Put them behind a firewall, VPN, or private network segment. Port 8265 is the one to watch.
• Turn on authentication for job submissions. Recent Ray builds support token auth, but it is off by default, so you have to switch it on.
• Watch for the tells: unexpected jobs hitting /api/jobs/, miner processes masquerading as system workers, CPU throttled near 60% to stay quiet, and new cron or systemd persistence.