01
CriticalRay FrameworkCISA KEV
Attackers are hijacking AI/ML clusters through Ray's unauthenticated dashboard, stealing GPU resources, credentials, and model weights, with a federal deadline of Thursday
Ray has no authentication on its dashboard or job submission API by design — the project maintainers declined to add it. CVE-2025-62593 turns that into a browser-based remote code execution path through DNS rebinding. But exploitation does not need DNS rebinding if the dashboard is internet-exposed: anyone who reaches port 8265 or 8000 can submit jobs and reach the file system directly.
CVECVE-2025-62593
CVSS 9.4
CVSS 9.4
KEV addedAugust 17, 2026
Fed deadlineAugust 20, 2026
(Thursday)
(Thursday)
Fixed inRay 2.52.0
Active campaignsRondoDox DDoS
ShadowRay 2.0
ShadowRay 2.0
What happened
CISA added CVE-2025-62593 to its Known Exploited Vulnerabilities catalog on August 17, 2026, citing evidence of active exploitation and setting a federal remediation deadline of August 20. Ray is an open-source Python framework for distributed computing used to scale AI and machine learning workloads across clusters of CPUs and GPUs. It is among the most widely deployed frameworks in production AI infrastructure. The vulnerability exists because Ray's dashboard and job submission API have no authentication. The Ray project maintainers made a deliberate architectural decision not to implement authentication on these endpoints, documenting instead that Ray should only be run in trusted network environments. CVE-2025-62593 specifically describes how the dashboard's insufficient browser guard, which checked only whether an HTTP User-Agent header began with the string "Mozilla," can be bypassed through a DNS rebinding attack. A developer browsing the web while running Ray locally can have their browser's same-origin protections bypassed by a malicious webpage, which then submits jobs to their Ray instance and executes arbitrary code. Oligo Security documented the ShadowRay 2.0 campaign, in which multiple threat actors exploited internet-accessible Ray clusters to take over GPU computing resources for cryptocurrency mining, steal cloud credentials, AI API tokens, proprietary model weights, and training data from compromised workloads, and in one case operated GitLab repositories as a live CI/CD pipeline for malware distribution. The threat actor named IronErn440 used Ray's legitimate orchestration features to propagate cryptojacking payloads across the cluster autonomously. Attackers also deployed a TCP state exhaustion tool called Sockstress on compromised clusters, suggesting DDoS capability. The RondoDox DDoS botnet incorporated CVE-2025-62593 into its arsenal two days before the vulnerability was publicly disclosed, indicating the flaw was known to attackers before the public advisory. Ray 2.52.0 addresses the vulnerability. CISA's KEV description notes the flaw is a code injection vulnerability that developers using Ray as a development tool may encounter when browsing with Firefox or Safari.
Why it matters
Ray clusters in production environments hold a category of assets distinct from standard IT infrastructure: GPU compute capacity, AI model weights that may represent months of training cost, proprietary training datasets, and the cloud and API credentials needed to run model inference at scale. A compromised Ray cluster gives an attacker those assets directly. GPU compute can be monetized immediately through cryptocurrency mining or resold through illegal compute brokers. Model weights and training data are intellectual property with direct commercial value. API credentials for AI providers such as Anthropic, OpenAI, and Google may carry usage costs in the tens of thousands of dollars before they are detected and revoked. The GitLab-as-C2-pipeline technique documented by Oligo adds a specific operational concern: an attacker using a legitimate public version control platform for command and control is significantly harder to detect and block than one using dedicated malware infrastructure, because connections to GitLab domains are expected and common in developer environments.
Don't miss
The Ray maintainers' decision not to implement authentication on the dashboard and job API is documented and explicit. CVE-2025-62593 is specifically about the DNS rebinding bypass of the browser guard that was the only partial mitigation for browser-based access. But the broader attack surface is not limited to DNS rebinding: any Ray instance with its dashboard or job API ports exposed to an untrusted network is accessible to direct unauthenticated API calls regardless of the CVE patch status. Upgrading to Ray 2.52.0 closes the DNS rebinding path. It does not add authentication to the dashboard or job API. A patched Ray instance that is accessible on ports 8265 or 8000 from untrusted networks is still reachable by direct unauthenticated API calls. Network isolation is not optional for Ray; it is the architectural prerequisite for secure deployment regardless of patch version.
Potential actions
- Upgrade all Ray installations to version 2.52.0 or later by Thursday's federal deadline. Confirm the upgrade with ray --version or by checking the installed package version, as Ray clusters may run across multiple nodes where not all may have been updated simultaneously.
- Restrict network access to Ray dashboard and job API ports, typically 8265 for the dashboard and 8000 for the serve endpoint, to trusted internal network ranges only. Place a firewall rule or security group rule that blocks all access to these ports from external and untrusted networks. This mitigation is necessary in addition to patching, because Ray 2.52.0 does not add authentication to these endpoints.
- For any Ray cluster that was accessible from untrusted networks before today, audit for signs of compromise: check for unexpected job submissions in the Ray dashboard history, review GPU utilization for unusual sustained loads, hunt for credential exfiltration from environment variables and mounted secrets, and rotate any AI provider API keys, cloud credentials, and tokens that were accessible to the Ray cluster's environment.
The Sip
Ray has no authentication on its dashboard or job API. CVE-2025-62593 patches the DNS rebinding bypass. It does not add authentication. Patch to 2.52.0 and then firewall those ports. If the cluster was reachable from an untrusted network, check the job history and rotate the AI provider keys. The compute and the credentials are both at risk.