Ray‑Project Ray Code Injection

Overview

The Cybersecurity and Infrastructure Security Agency (CISA) has added a critical Ray‑Project Ray vulnerability (CVE‑2025‑62593) to its Known Exploited Vulnerabilities (KEV) catalog after confirming exploitation in the wild. The flaw allows remote code execution on systems running vulnerable Ray development environments, posing a serious risk to developers and AI teams.

Vulnerability Details

• CVE‑2025‑62593: Improper protections for Ray HTTP API endpoints.
• Affected versions: Ray releases before 2.52.0.
• Attack vector: Exploitable via browser exposure (especially Firefox and Safari).
• Weak filter: Ray attempted to block browser access by checking if the User‑Agent began with “Mozilla,” but attackers bypassed this using browser request manipulation.
• Techniques used:
  • DNS rebinding tricks a victim’s browser into communicating with local/internal services.
  • Code injection enables arbitrary execution with Ray process privileges.

Attack Scenario

1. Developer runs an outdated Ray instance locally.
2. Victim visits a malicious website or advertisement.
3. Attacker‑controlled page sends crafted requests to the Ray service.
4. Arbitrary code executes with the privileges of the Ray process.

This vulnerability is associated with CWE‑94 (improper control of code generation) and CWE‑352 (cross‑site request forgery).

Exploitation Status

• Confirmed exploitation: CISA verified attacks in the wild.
• KEV catalog entry: Added on August 17, 2026, with a remediation deadline of August 20, 2026.
• Unknown actors: No details yet on ransomware use, victims, or threat groups.

Defensive Guidance

Organizations should:

• Upgrade Ray: Patch to version 2.52.0 or later immediately.
• Rebuild images: Ensure container images and dependencies don’t retain vulnerable releases.
• Restrict exposure: Avoid exposing Ray dashboards/APIs to untrusted networks.
• Apply segmentation: Use VPNs, authenticated proxies, and firewall rules.
• Monitor logs: Look for unusual job submissions, suspicious API requests, or unauthorized commands.
• Follow CISA guidance: Apply vendor mitigations and assess internet exposure per BOD 26‑04.

Expert in the Cloud Insight

This incident highlights how AI development frameworks like Ray can become high‑value targets. Because exploitation requires only a malicious webpage and an outdated Ray instance, developers are uniquely exposed. The lesson is clear: AI infrastructure must be treated with the same rigor as production systems, with strict patching, segmentation, and monitoring.