Which Ray versions are affected by CVE-2025-62593?

CVE-2025-62593 affects every release of Ray before 2.52.0, according to the ray-project security advisory. Ray 2.52.0 is the patched version. Anyone running an older Ray dashboard on a developer machine or a cluster should upgrade, because the fix is the only mitigation the advisory names for the browser-based attack path.

Does upgrading to Ray 2.52.0 turn on authentication automatically?

No. Ray 2.52.0 adds optional token-based authentication, but The Register reports it stays disabled by default. Upgrading closes the specific User-Agent and DNS rebinding hole described in CVE-2025-62593, so the patch is worth applying on its own, but teams that want authenticated Ray endpoints have to switch the new token option on themselves.

Who is most at risk from the Ray browser attack?

The ray-project advisory names developers running Ray in development or testing environments as the group most at risk. The attack fires when such a developer visits a malicious page in Firefox or Safari, so phishing email and malicious advertising are the realistic delivery routes. A Ray instance bound to localhost is still reachable this way.

Does the CISA deadline apply to private companies?

The August 20, 2026 deadline in the CISA Known Exploited Vulnerabilities catalog binds US federal civilian executive branch agencies. Private companies are not covered by that order. CISA cut the window to three days rather than the usual fourteen under Binding Operational Directive 26-04, which signals how urgent it considers the Ray flaw for everyone.

CISA · 2026-08-17 · major

Ray RCE hits CISA's exploited list — federal agencies get three days to patch

CISA added CVE-2025-62593, a critical remote code execution bug in the Ray AI compute framework, to its Known Exploited Vulnerabilities catalog on August 17. Federal agencies have until August 20 to move to Ray 2.52.0.

The Register report on CISA ordering federal agencies to patch the Ray remote code execution flaw

A Ray flaw first disclosed in November 2025 is now on CISA's actively-exploited list with a three-day federal patch deadline.

Key specs

Cvss v4 score	9.4

Quick facts

CVE	CVE-2025-62593
Affected	Ray before 2.52.0
Fix	Upgrade to Ray 2.52.0
Federal deadline	August 20, 2026
Attack path	DNS rebinding via Firefox or Safari
Seen in the wild	RondoDox botnet, ShadowRay 2.0

What is it?

CISA added CVE-2025-62593 to its Known Exploited Vulnerabilities catalog on August 17, 2026. The bug is a critical remote code execution flaw in Ray, the distributed compute framework used to train and serve AI models. It scores 9.4 on CVSS v4 and affects every Ray version before 2.52.0.

How does it work?

The Ray dashboard tried to block browser requests by checking whether the HTTP User-Agent header began with "Mozilla". Firefox and Safari let a page rewrite that header through the fetch API, so the check fails open. An attacker pairs that bypass with DNS rebinding, which makes the browser treat the attacker's server and the victim's local Ray instance as the same origin, and then submits a job that runs code. Avi Lumelsky of Oligo found the header bypass and Jonathan Leitschuh built the rebinding chain.

Why does it matter?

Ray sits under a lot of AI infrastructure. The Register cites 7 million weekly downloads, about a million monthly active users, and deployments at Amazon, Apple and OpenAI. Attackers are not waiting: the RondoDox DDoS botnet added the flaw two days before public disclosure, and the ShadowRay 2.0 campaign turns unpatched Nvidia GPU clusters into self-spreading crypto miners. The advisory traces the root cause to Ray's long-standing choice not to authenticate critical endpoints.

Who is it for?

ML platform and infrastructure teams

Frequently asked questions

Which Ray versions are affected by CVE-2025-62593?: CVE-2025-62593 affects every release of Ray before 2.52.0, according to the ray-project security advisory. Ray 2.52.0 is the patched version. Anyone running an older Ray dashboard on a developer machine or a cluster should upgrade, because the fix is the only mitigation the advisory names for the browser-based attack path.
Does upgrading to Ray 2.52.0 turn on authentication automatically?: No. Ray 2.52.0 adds optional token-based authentication, but The Register reports it stays disabled by default. Upgrading closes the specific User-Agent and DNS rebinding hole described in CVE-2025-62593, so the patch is worth applying on its own, but teams that want authenticated Ray endpoints have to switch the new token option on themselves.
Who is most at risk from the Ray browser attack?: The ray-project advisory names developers running Ray in development or testing environments as the group most at risk. The attack fires when such a developer visits a malicious page in Firefox or Safari, so phishing email and malicious advertising are the realistic delivery routes. A Ray instance bound to localhost is still reachable this way.
Does the CISA deadline apply to private companies?: The August 20, 2026 deadline in the CISA Known Exploited Vulnerabilities catalog binds US federal civilian executive branch agencies. Private companies are not covered by that order. CISA cut the window to three days rather than the usual fourteen under Binding Operational Directive 26-04, which signals how urgent it considers the Ray flaw for everyone.

Try it

pip install -U "ray>=2.52.0"