CISA Warns of Critical Ray RCE Flaw Exploited in Active Attacks

CVE-2025-62593 is a critical RCE, CVSS 4.0 base 9.4, CWE-94 code injection combined with CWE-352 CSRF, in Ray releases before 2.52.0. Ray has never authenticated its Jobs API endpoints /api/jobs and /api/job_agent/jobs/, and its only defense against browser delivery is a check that the User-Agent header starts with "Mozilla". Firefox and Safari allow a page to set that header through fetch, which Chrome refuses because of a Chromium bug, so a DNS rebinding attack against a developer browsing with Firefox or Safari reaches the local Ray dashboard on port 8265 and submits arbitrary code as a job, with no exposed port and no credentials. Anyscale published the advisory GHSA-q279-jhrf-cc6v on November 26, 2025 with a working PoC built on nccgroup/singularity and fix commit 70e7c72780bdec075dba6cad1afe0832772bfe09, and CISA added the CVE to the KEV catalog on August 17, 2026 confirming exploitation in active attacks, with federal remediation due August 20.

The exposed population is developer workstations, not a server fleet, and that changes what defense looks like. The advisory states the same browser flow works as a confused-deputy pivot against network-adjacent Ray instances inside a private corporate network, so one developer loading a malvertised page can hand an attacker code execution in the subnet where training jobs and their cloud credentials live, a path no external attack-surface scanner will ever flag because nothing is exposed to the internet. The KEV confirmation also has history the event stream does not show: Bitsight honeypot telemetry published March 11, 2026 caught the RondoDox botnet using an exploit for CVE-2025-62593 on November 24, 2025, two days before the CVE published, so working exploit code circulated ahead of coordinated disclosure. The same analysis shows RondoDox's implementation defeats itself, because its payload sends User-Agent Mozilla/5.0 (rondo2012@atomicmail.io) and trips the 405 browser guard the exploit exists to bypass, which means the exploitation CISA confirmed most likely involves actors more capable than the one currently visible in honeypots.

Upgrade every Ray install to 2.52.0 or later, then enable the token authentication feature that ships in 2.52.0 disabled by default, because the fix closes the browser path while the Jobs API itself remains unauthenticated, and federal civilian agencies have an August 20, 2026 deadline. For the hunt, review Ray dashboard logs on port 8265 for POSTs to /api/jobs/ or /api/job_agent/jobs/ whose User-Agent does not start with Mozilla, since the public PoC sends the literal value "Other", and for job submissions carrying metadata source "nccgroup/singluarity" or shell entrypoints. HTTP 405 responses reading "Browser requests not allowed" mean someone probed the guard. In DNS telemetry, flag external hostnames resolving to RFC1918 addresses, the rebinding signature, and on endpoints watch for calculator binaries or unexpected shells spawned by ray or dashboard processes on developer machines. Alert on the RondoDox payload hosts rondo.jbt.sh and rondo.zqq.sh and on User-Agents containing rondo2012@atomicmail.io or bang2012@protonmail.com. Where hosts cannot be patched quickly, restrict port 8265 to loopback or a management network and keep browsers off machines that run Ray.

Two developments would move this assessment. A working browser-delivered variant, malvertising or phishing paired with DNS rebinding against Firefox and Safari users, would turn this from botnet shotgun noise into quiet developer-workstation compromise that perimeter telemetry never sees, and today the only publicly documented in-the-wild implementation is self-defeating. Attribution of the KEV exploitation to an actor beyond RondoDox, or telemetry showing mass scanning of directly exposed dashboards on port 8265, would confirm the higher-capability path, and any plain HTTP client that omits a Mozilla User-Agent was never stopped by the guard, so exposed instances need no browser at all.