Ray AI Framework CVE-2025-62593: CISA Orders 3-Day Emergency Patch — What MLOps Teams Must Do Now
On August 17, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) did something that should make every MLOps engineer pause mid-deploy. They added CVE-2025-62593 to the Known Exploited Vulnerabilities (KEV) catalog — a designation reserved for flaws already being weaponized in the wild — and gave federal agencies a blistering three-day patch window. The target? Ray, the open-source distributed computing framework that quietly powers machine learning pipelines at OpenAI, Uber, Netflix, Shopify, and thousands of other organizations.
This is not a theoretical vulnerability. Ray AI framework CVE-2025-62593 is a confirmed, actively exploited remote code execution flaw hitting production ML clusters right now. And because of how Ray is architected — and how MLOps teams typically expose dashboards and Jupyter notebooks — this attack reaches deeper into AI infrastructure than most organizations realize.
What Is Ray and Why Does This CVE Matter?
Ray is the infrastructure layer that much of modern AI sits on. Developed at UC Berkeley’s RISELab and now an Apache Software Foundation project, it provides a unified framework for distributed Python workloads. Training large models, serving inference at scale, running hyperparameter sweeps, orchestrating reinforcement learning — if it needs to run across dozens or thousands of nodes, Ray is often the glue holding it together.
The adoption numbers are staggering. OpenAI uses Ray to distribute reinforcement learning workloads. Uber built its entire Michelangelo ML platform on top of it. Netflix uses Ray for content recommendation pipeline orchestration. Shopify, Ant Group, ByteDance, and a growing slice of the Fortune 500 rely on Ray clusters to train and serve models that drive core business logic.
Which is precisely why a remote code execution vulnerability in Ray is not just a “project security issue.” It is a supply-chain event with cascading consequences. Unlike a compromised npm package that might affect a frontend build, an exploited Ray cluster gives an attacker arbitrary code execution on the same machines training proprietary models, processing sensitive inference requests, and accessing training datasets that may contain regulated data. An RCE here does not just disrupt operations — it potentially exfiltrates intellectual property, poisons models, or pivots laterally into broader cloud environments — the same blast radius we detailed in the Hugging Face Transformers remote code execution vulnerability, which similarly weaponizes trusted ML tooling.
The Vulnerability: Ray AI Framework CVE-2025-62593 Explained
The technical details of Ray AI framework CVE-2025-62593 reveal an attack vector that many security teams are underprepared for: DNS rebinding delivered through mainstream web browsers.
The DNS Rebinding Angle
At its core, DNS rebinding exploits the browser’s same-origin policy enforcement gap. An attacker-controlled domain resolves to an attacker IP initially, then rapidly rebinds to resolve to an internal Ray dashboard IP. Because the browser believes it is still communicating with the same origin — thanks to DNS caching quirks and relaxed rebinding protections in Firefox and Safari — the attacker’s JavaScript can make authenticated requests to the internal Ray dashboard as if it were a same-site call.
This is not a new class of attack. DNS rebinding has existed in security literature for over two decades. What makes CVE-2025-62593 novel and dangerous is the intersection of three factors:
- Ray’s dashboard and API endpoints trust browser-originated requests in ways that assume network segmentation provides sufficient protection.
- Firefox and Safari’s DNS rebinding mitigations remain weaker than Chrome’s, creating a reliable attack path through browsers that enterprise users commonly run.
- ML clusters are often reachable from internal networks where users browse, meaning a phishing email that gets one user to visit an attacker site on a corporate machine can pivot directly into the training infrastructure.
How Browser-Based RCE Reaches ML Clusters
Once the rebinding succeeds, the attacker can interact with Ray’s dashboard REST API and job submission endpoints. From there, the exploitation path is direct: submit a malicious Python job, gain code execution on the Ray head node, and leverage Ray’s internal cluster communication to propagate laterally across worker nodes. The result is full cluster compromise initiated from a user simply browsing to a malicious webpage in Firefox or Safari on a machine with internal network access.
Security researchers assessing the flaw have assigned it a CVSS 3.1 score of 9.8 (Critical). The vector string reads CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network exploitable, low attack complexity, no privileges required, no user interaction needed after the initial browser visit, and full impact on confidentiality, integrity, and availability. In practical terms, if an attacker can get a browser inside your perimeter to hit their rebinding domain, your Ray cluster is theirs.
Why Network Segmentation Fails Here
Traditional security architecture assumes that putting infrastructure on internal networks behind VPNs and firewalls is sufficient. DNS rebinding systematically undermines this assumption by turning the user’s browser into a confused deputy — a trusted internal agent that willingly makes unauthorized requests to protected services. If your Ray dashboard is reachable from any machine that also runs a web browser, and that machine uses Firefox or Safari, your segmentation strategy has a hole that CVE-2025-62593 drives straight through.
CISA KEV Entry: The 3-Day Clock
CISA’s August 17, 2026 KEV listing is the signal that this has moved from “interesting research” to “active threat.” The KEV catalog is not an aggregation of every CVE; it is a curated, evidence-based list of vulnerabilities that CISA has confirmed are being exploited in the wild against U.S. government and critical infrastructure targets. Inclusion means there is forensic or intelligence evidence of active attacks, not just theoretical exploitation.
For federal civilian agencies, Binding Operational Directive 22-01 mandates remediation within specific windows based on severity. Critical vulnerabilities like this one carry a three-day patch or mitigation requirement — an emergency timeline that reflects CISA’s assessment of both the exploitability and the operational impact.
To put that in perspective: typical enterprise patch cycles run 30 to 90 days for non-critical systems. Even well-organized security teams often need two weeks to regression-test patches in staging environments before production deployment. CISA is saying, in effect, that neither timeline is acceptable here. The risk of leaving Ray unpatched over a weekend outweighs the operational risk of an accelerated deployment.
Private-sector organizations are not legally bound by BOD 22-01, but CISA’s KEV timeline is widely treated as a leading indicator. Cyber insurance policies increasingly reference KEV remediation windows in coverage terms. Boards and CISOs use CISA’s urgency signals to prioritize resources. When CISA says three days for a KEV entry, the smart money in enterprise security treats it as a “patch now, ask questions later” event regardless of regulatory obligation.
Who Is Affected?
The short answer: if you run Ray, you should assume you are in the blast radius until proven otherwise. The longer answer depends on your architecture and exposure.
Direct Exposure Scenarios
Organizations running Ray clusters with browser-accessible dashboards are at highest risk. This includes:
- Ray clusters with dashboards exposed on internal networks where users browse
- Jupyter notebook environments co-located with or proxied to Ray head nodes
- Development and staging clusters that engineers reach through VPNs
- Any Ray deployment where the head node’s REST API listens on an address reachable from workstations running Firefox or Safari
Public-Facing vs. Internal-Only Deployments
Publicly exposed Ray dashboards are obviously critical and should have been locked down long before this CVE. But the subtler risk is internal-only deployments. The DNS rebinding attack does not require direct internet exposure of the Ray dashboard. It only requires that an internal user’s browser can reach both the attacker’s domain and the Ray dashboard. In a typical enterprise environment — where VPN-connected laptops have routes to internal training clusters, and where users browse the web through corporate proxies — that condition is almost always met.
Cloud and Kubernetes Environments
Ray runs everywhere: bare metal, EC2 instances, GKE clusters, EKS, Azure AKS, and custom Kubernetes deployments. The vulnerability is in Ray’s core API layer, not infrastructure-specific. Whether your cluster auto-scales on spot instances or sits on-prem in a GPU rack, if it runs an affected Ray version and the head node is reachable from browser-equipped hosts, the risk applies.
Organizations using managed Ray services — such as Anyscale’s hosted platform — should verify that their provider has already applied mitigations. Do not assume; verify through official communications and status pages.
Immediate Mitigation Steps
If you are reading this and have not yet patched, the following actions are ordered by urgency and impact.
1. Patch Immediately
The Ray project released patched versions concurrently with the CISA KEV listing. Upgrade to the latest patched release in the 2.x line. Check the Ray security bulletin and the official GitHub releases page for the exact version numbers, as subsequent point releases may further harden the fix.
For most teams, the patch path looks like:
1 | pip install -U "ray>=2.XX.X" # replace with patched version |
After upgrading, restart your Ray head nodes and worker processes. The patch addresses the underlying API trust model that allowed rebinding requests to execute jobs.
2. Temporary Workarounds (If Patching Is Delayed)
If operational constraints prevent immediate patching — for example, if a long-running training job cannot be interrupted without significant cost — implement these compensating controls immediately:
- Disable the Ray dashboard entirely if it is not operationally required. Start Ray with
include_dashboard=Falseor the equivalent configuration flag. - Restrict dashboard access to localhost only on head nodes. Ensure the dashboard binds to
127.0.0.1and is not reachable from other hosts. - Block Ray dashboard ports at the host firewall level for all sources except strictly necessary administrative hosts.
3. Network-Level Mitigations
Even after patching, these controls reduce residual risk:
- Deploy DNS rebinding protections at your recursive DNS resolver. Modern DNS infrastructure supports filtering of suspiciously short TTL records and rapid rebinding patterns. Enable these if available.
- Implement strict egress filtering on networks hosting Ray clusters. Limit outbound DNS resolution to trusted resolvers that log and inspect queries.
- Apply browser security policies across your enterprise. If your endpoint management supports it, push policies that strengthen same-origin enforcement or restrict Firefox/Safari access to internal resources until vendor patches arrive.
4. Detection and Logging
Assume positive intent on patching, but verify with detection. The following indicators suggest potential exploitation:
- Unexpected job submissions to Ray clusters, especially from unknown client IPs or user tokens
- Python processes spawned by Ray workers executing shell commands, network connections, or file system access outside normal training patterns
- DNS query logs showing rapid sequential resolves of the same domain to different IPs, particularly internal addresses
- Browser origin headers on Ray REST API requests that do not match your expected administrative tools
Enable verbose logging on Ray head nodes and ship logs to your SIEM or centralized logging platform. If you have network traffic inspection capabilities, monitor for HTTP requests to Ray dashboard endpoints that carry unusual origin or referrer headers.
The Bigger Picture: MLOps Security in 2026
CVE-2025-62593 is not an isolated incident. It is a data point in a pattern that security and ML engineering teams can no longer afford to ignore: AI infrastructure is now high-value attack surface, and the open-source tools powering it were not designed with adversarial threat models in mind.
ML Frameworks as Prime Targets
Over the past two years, we have seen critical vulnerabilities in Hugging Face Transformers, TensorFlow’s saved model deserialization, PyTorch’s loading pipeline, and now Ray’s cluster management layer. The common thread is that these tools were built for researcher productivity and developer ergonomics, not for multi-tenant, internet-adjacent, adversarial environments. Security boundaries were often “assumed” rather than enforced — assumed that the network is trusted, assumed that model weights come from friendly sources, assumed that the user submitting a training job is legitimate.
Attackers have noticed. ML pipelines represent concentrated value: expensive GPU compute, proprietary model weights, massive training datasets, and privileged cloud credentials. A compromised Ray cluster is not just a temporary outage. It is a beachhead for model theft, data exfiltration, and supply-chain poisoning that can propagate downstream through model registries and inference endpoints.
The Open-Source Security Rethink
Ray’s CVE should accelerate a conversation that the open-source AI community has been slow to embrace. Projects like Ray, PyTorch, and TensorFlow need security architectures that match their deployment contexts. That means:
- Authenticated and authorized APIs by default, not as optional plugins
- Network-hardened defaults that assume browser-adjacent and co-located threats
- Security disclosure and response processes that match enterprise dependency expectations
- Software bills of materials (SBOMs) and signed releases that downstream consumers can validate
The maintainers of these projects are not at fault for original design choices made in academic labs. But the deployment context has changed, and the threat model must change with it — a shift we’ve also tracked at the kernel level in our coverage of GhostLock’s 15-year-old container escape bug.
Lessons for Teams Running Distributed Training
For MLOps teams, the operational takeaway is clear: treat your ML infrastructure with the same security rigor you apply to production customer-facing applications. This includes:
- Segmenting training clusters from general corporate networks
- Requiring mutual TLS and strong authentication for all Ray and Jupyter APIs
- Running threat modeling exercises that include browser-based and insider-adjacent attack vectors
- Maintaining inventory of open-source ML dependencies with automated vulnerability scanning
- Practicing incident response for cluster compromise scenarios, not just application-layer breaches
Bottom Line
Ray AI framework CVE-2025-62593 is actively exploited, critical in severity, and trivial to weaponize through common browsers. If your organization runs Ray clusters, patch to the latest fixed version immediately. If patching is genuinely blocked, disable dashboards, firewall off access, and monitor for indicators of compromise. CISA’s three-day federal window is not bureaucratic theater — it is an objective signal of how quickly this flaw is being abused in the wild.
The days of treating MLOps infrastructure as an internal science experiment with relaxed security postures are over. AI infrastructure is production infrastructure. It is time we secured it that way.
References and further reading
- CISA Known Exploited Vulnerabilities Catalog Entry — CVE-2025-62593
- CVE-2025-62593 — NVD
- Ray Security Bulletin and Patched Versions
- Ray GitHub Releases
- CISA Binding Operational Directive 22-01 — Reducing the Significant Risk of Known Exploited Vulnerabilities
Please let us know if you enjoyed this blog post. Share it with others to spread the knowledge! If you believe any images in this post infringe your copyright, please contact us promptly so we can remove them.