CISA Flags Critical Ray AI Framework Flaw as Attackers Exploit Browser-Based Code Execution Bug

A critical vulnerability in the Ray open-source AI framework is being actively exploited in the wild, prompting U.S. federal agencies to patch their systems by August 20, 2026, as threat actors deploy the flaw to hijack GPU clusters and build cryptocurrency mining botnets.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2025-62593 to its Known Exploited Vulnerabilities (KEV) catalog on Monday, August 18, 2026, confirming active exploitation of the flaw. With a CVSS score of 9.4, the vulnerability affects Ray — a Python-native distributed computing framework widely used to scale artificial intelligence and machine learning workloads. The GitHub project has accumulated more than 43,500 stars and has been forked over 7,900 times, underscoring how deeply embedded the tool is across the global developer community.

Understanding the broader risk here requires appreciating why cybersecurity matters for modern software infrastructure — particularly when widely adopted open-source frameworks become attack surfaces at this scale.

---

What Makes This Vulnerability So Dangerous

At its core, CVE-2025-62593 enables remote code execution (RCE) through browsers including Mozilla Firefox and Apple Safari by means of a DNS rebinding attack. The flaw exploits the longstanding absence of authentication controls on critical Ray API endpoints.

"Due to the longstanding decision by the Ray Development team to not implement any sort of authentication on critical endpoints, like the /api/jobs and /api/job_agent/jobs/, has once again led to a severe vulnerability that allows attackers to execute arbitrary code against Ray," the project maintainers stated in a November 2025 advisory.

The attack scenario is deceptively straightforward. A developer running Ray in a local testing or development environment only needs to visit a malicious website or be served a compromised advertisement for the exploit to trigger. The vulnerability is compounded by insufficient controls against browser-based attacks — specifically, scenarios where the User-Agent header can be manipulated.

"Combined with a DNS rebinding attack against the browser, this vulnerability is exploitable against a developer running Ray who inadvertently visits a malicious website or is served a malicious advertisement," the maintainers added.

Making matters worse, attackers can extend the breach beyond the developer's machine. By leveraging the browser as a confused deputy intermediary, threat actors can pivot to target Ray instances running inside private corporate networks — turning a single compromised endpoint into a gateway for deeper intrusion.

Why DNS Rebinding Is Particularly Insidious

DNS rebinding is not a new technique, but it remains stubbornly effective against frameworks that lack authentication layers. In this attack model, a malicious website manipulates DNS resolution to trick the victim's browser into treating the attacker's server as a trusted local host. Once that trust boundary collapses, the browser can be weaponised to issue requests to internal services — including Ray's unauthenticated API endpoints — entirely without the developer's knowledge.

The absence of authentication on Ray's critical endpoints effectively removes the last line of defence in this scenario. Even a developer who exercises caution online is exposed simply by having Ray running locally while browsing.

---

How Threat Actors Moved Faster Than Disclosure

The RondoDox Botnet and Pre-Disclosure Exploitation

The timeline of exploitation reveals how aggressively bad actors monitored this vulnerability. A BitSight report from March 2026 found that the operators behind the RondoDox DDoS botnet had incorporated the flaw into their toolkit just two days before it was publicly disclosed on November 26, 2025. Their early access was made possible by the availability of a proof-of-concept (PoC) exploit circulating before official disclosure — a reminder that responsible disclosure timelines are increasingly difficult to control.

ShadowRay 2.0 and GPU Cryptomining at Scale

Separately, security firm Oligo reported that unpatched Ray instances have been targeted in a campaign dubbed ShadowRay 2.0. In this operation, attackers compromised clusters equipped with NVIDIA GPUs and converted them into a self-replicating cryptocurrency mining botnet — a financially motivated attack that exploits the raw computational power of AI infrastructure at scale. The attackers essentially commandeer expensive GPU resources, running their own workloads silently while legitimate owners absorb the operational and energy costs.

CISA has not publicly shared specifics on how the vulnerability is currently being exploited in the wild beyond its KEV listing. However, the combination of the RondoDox botnet activity and the ShadowRay 2.0 campaign paints a clear picture of organised and opportunistic exploitation across multiple threat actor groups.

What This Means for Open-Source AI Tooling

The speed of exploitation in this case reflects a wider trend: threat actors are increasingly monitoring developer ecosystems, open-source repositories, and security mailing lists to identify and weaponise vulnerabilities before patches are widely deployed. Frameworks embedded deep in AI and machine learning pipelines are particularly attractive targets because they frequently operate with elevated system privileges and access to high-value compute resources.

Conducting a thorough vulnerability assessment of your development and production environments is an essential step for any organisation running open-source frameworks at scale — especially where those frameworks interface with GPU infrastructure or internal networks.

---

Who Discovered the Flaw and What You Should Do Now

The Researchers Behind the Discovery

The vulnerability was identified by two researchers. Oligo security researcher Avi Lumelsky discovered the fetch bypass component, while Jonathan Leitschuh developed the DNS rebinding attack vector. Their combined work exposed a multi-layered threat that required both browser-level manipulation and network-level deception to execute fully.

Patching and Immediate Mitigation Steps

Ray has addressed the issue in version 2.52.0 of the Python package. Developers and organisations using Ray in any environment — development, testing, or production — should update immediately.

Federal Civilian Executive Branch (FCEB) agencies face a binding deadline of August 20, 2026 to apply fixes and mitigations. While that directive applies specifically to federal entities, private sector organisations and individual developers should treat the same date as an urgent benchmark.

For organisations relying on Ray to power AI and machine learning pipelines, the implications extend beyond a single patch. The absence of authentication on critical API endpoints has been a known architectural concern, and this vulnerability is described by maintainers as a recurring consequence of that design choice.

Practical Steps for Developers and Security Teams

Developers running Ray locally should audit their environments for:

• Unexpected processes or background services
• Unusual network activity originating from Ray instances
• GPU utilisation spikes that could indicate illicit cryptomining activity

Organisations should also review network segmentation policies to limit Ray instances' exposure within internal corporate environments. Isolating Ray deployments from broader internal network access significantly reduces the blast radius of a successful DNS rebinding attack.

Staying current with CISA's KEV catalog is a practical discipline for any security team — it surfaces real-world threats before they reach your infrastructure. Subscribing to vulnerability advisories from frameworks embedded in your development stack can give your team critical lead time before exploitation becomes widespread. For a broader foundation, understanding how to protect web-facing applications and services from exploitation provides essential context for securing the environments in which tools like Ray typically operate.

For the latest official guidance on CVE-2025-62593, refer to the CISA Known Exploited Vulnerabilities catalog, which is updated continuously as new threats are confirmed.