CISA Adds Ray AI Framework RCE Flaw to KEV Catalog

Introduction

On August 17, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2025-62593 to its Known Exploited Vulnerabilities (KEV) catalog, giving federal civilian agencies until August 20, 2026 — just three days — to remediate under Binding Operational Directive 26-04. The flaw carries a CVSS v4.0 score of 9.4 and affects Ray, an open-source distributed computing framework that companies including Amazon and OpenAI use to scale machine learning training and serving workloads, according to Anyscale, Ray's lead commercial backer.

What makes this vulnerability notable isn't just its severity score. It requires only "passive" user interaction — a developer with a vulnerable Ray instance running simply has to visit a malicious website or load a malicious ad in a browser tab for an attacker to reach that instance and execute arbitrary code.

Feature Overview: How the Flaw Works

Ray's dashboard exposes a job-submission API, including endpoints like /api/jobs, that Ray developers use to launch and manage distributed compute jobs. According to Ray's own GitHub security advisory (GHSA-q279-jhrf-cc6v), the dashboard tried to block browser-originated requests to these endpoints by checking whether the request's User-Agent header started with "Mozilla." The reasoning, as the advisory describes it, was that this check is "hard for a browser to bypass" because "fetch/xhr and friends cannot alter the user-agent."

That assumption held for Chrome — which blocks User-Agent modification via a spec-compliance quirk — but not for Firefox or Safari, both of which permit their Fetch APIs to override the header. Combined with a DNS rebinding attack, which tricks a browser into treating an attacker-controlled domain as if it resolves to a victim's local Ray instance, this let attackers submit forged POST requests to Ray's job-submission endpoint with a spoofed User-Agent, achieving remote code execution.

Key technical details, per the GitHub advisory and CISA's KEV entry:

• Affected versions: Ray prior to 2.52.0
• Patched version: Ray 2.52.0
• CWE classifications: CWE-94 (Code Injection) and CWE-352 (Cross-Site Request Forgery)
• Attack vector: Network, with low attack complexity and only passive user interaction required
• Impact: High confidentiality, integrity, and availability impact
• Credited to researcher JLLeitschuh of Socket, building on theoretical groundwork from avilum of Oligo Security

Usability Analysis: What This Means in Practice

For an individual developer, exploitation requires two conditions to line up: a Ray dashboard reachable from the attacker's rebinding attempt (commonly the case during local development, where Ray's dashboard defaults to an accessible local port), and the developer visiting a compromised or malicious page in Firefox or Safari while that instance is running. Neither condition is exotic, which is why CISA classified this as a genuine risk to federal systems rather than a theoretical one.

CISA's three-day remediation window for federal civilian agencies — a notably short turnaround under BOD 26-04 — signals how seriously the agency treats exposure in AI/ML tooling that increasingly sits inside government and enterprise pipelines. For teams outside the federal requirement, the practical guidance is the same: upgrade to Ray 2.52.0 or later, and treat the dashboard as something that should never be exposed directly to an untrusted network in the first place.

Ray 2.52.0 also introduces an optional token-based authentication mechanism for these critical endpoints. It is a meaningful hardening step beyond the old header heuristic, but it ships disabled by default — so upgrading alone does not turn it on.

Pros and Cons

Pros:

• Ray's maintainers shipped a patched release (2.52.0) that directly closes the specific attack path CISA flagged
• The public GitHub security advisory documents the exact endpoints, root cause, and attack chain, letting affected teams verify their exposure quickly rather than guessing
• Ray 2.52.0 adds an optional token-based authentication layer, giving teams a real configuration-based defense in place of the previous User-Agent heuristic
• CISA's KEV listing puts pressure on the broader ecosystem — not just federal agencies — to prioritize patching a framework widely used in AI infrastructure

Cons:

• The original defense (checking whether a header starts with "Mozilla") was a weak, easily-defeated heuristic rather than real authentication
• The new token-based authentication in 2.52.0 is opt-in and disabled by default, so a freshly upgraded instance is still unauthenticated unless a team manually enables it
• Exploitation requires no active input from the victim beyond visiting a webpage — CISA classifies the required user interaction as passive, which is a low bar for attackers
• Ray's dashboard has historically defaulted toward being reachable during local development, a pattern that has enabled multiple unrelated Ray security incidents in the past

Outlook

CISA's short remediation window for federal agencies is likely to accelerate broader scanning and patching activity across organizations running Ray, particularly given the framework's footprint inside AI training and serving pipelines at companies like Amazon and OpenAI. The bigger open question is whether the ecosystem shifts token-based authentication from opt-in to a secure-by-default posture in a future release — the same gap that made this specific browser-based attack possible in the first place. As more AI infrastructure tooling gets built with local-first, developer-friendly defaults, expect continued scrutiny of similar assumptions elsewhere in the stack.

Conclusion

CVE-2025-62593 is a reminder that the security of AI systems depends as much on the scaffolding underneath them — job schedulers, dashboards, orchestration APIs — as on the models themselves. Teams running Ray, even in local development, should upgrade to 2.52.0 and explicitly enable the new authentication rather than assume the update alone closes the gap. For engineering and security leads evaluating AI infrastructure risk, this is a concrete, well-documented case worth reviewing directly against your own deployment.

Editor's Verdict

CISA Adds Ray AI Framework RCE Flaw to KEV Catalog earns a solid recommendation within the IT news space.

The strongest case for paying attention: Ray's maintainers shipped a patched release (2.52.0) that directly closes the flagged attack path. That alone raises the bar for what readers should expect in this space. Reinforcing that, the public GitHub security advisory documents the exact endpoints and attack chain, letting teams verify exposure quickly — practical value rather than just headline appeal. The broader signal worth registering is straightforward: CVE-2025-62593 carries a CVSS v4.0 score of 9.4 and enables remote code execution simply by visiting a malicious webpage while a vulnerable, reachable Ray instance is running. On the other side of the ledger, one constraint is real rather than a marketing footnote: the original defense — checking for a "Mozilla"-prefixed User-Agent header — was a weak, easily-defeated heuristic rather than real authentication. It should factor into any serious decision. Layered on top of that, the new token-based authentication in 2.52.0 is disabled by default, so a freshly upgraded instance remains unauthenticated unless manually configured — which narrows the set of teams for whom this is an obvious yes.

For AI industry watchers, strategy teams, and decision-makers tracking platform shifts, this is a serious evaluation candidate, not just a curiosity to bookmark. For everyone else, the safer posture is to monitor coverage and revisit once the use cases that matter to your team are demonstrated in the wild.