CISA lists Ray: Browsers run cluster jobs without login
On 17 August, the Cybersecurity and Infrastructure Security Agency (CISA) adds Ray to its Known Exploited Vulnerabilities (KEV) Catalog. Firefox and Safari launch jobs without login once DNS rebinding bypasses the User-Agent filter. The deadline for US agencies falls three days later.
Key takeaways
- CISA adds CVE-2025-62593 to the KEV Catalog. Its inclusion on 17 August 2026 follows evidence of active exploitation.
- Firefox and Safari bypass the User-Agent filter. DNS rebinding reaches the jobs interface when Ray runs locally or on a neighbouring network.
- Version 2.52.0 fixes the filter. The same release introduces token authentication, which remains off by default.
- The deadline applies only to US agencies. Federal Civilian Executive Branch (FCEB) agencies have until 20 August 2026. Whether ransomware exploits the flaw remains unknown.
Related: LoadMaster on the KEV list: Patch available since June · KEV under BOD 26-04 – EPSS ranks the rest
CISA adds Ray to the KEV Catalog
What is Ray? Ray is an open-source Python framework that distributes computing jobs across multiple machines. Without token authentication, its Jobs API accepts submissions without login.
On 17 August 2026, CISA added a single vulnerability to its Known Exploited Vulnerabilities Catalog: CVE-2025-62593, listed as code injection in Ray. The addition follows evidence of active exploitation. CISA’s brief alert does not describe attacks observed in the wild.
Under Binding Operational Directive (BOD) 26-04, Federal Civilian Executive Branch agencies must prioritise KEV entries affecting publicly accessible systems. This entry’s due date is 20 August 2026. CISA also requires checking for prior compromise before patching. The directive binds only US civilian agencies. CISA advises all organisations to apply the same risk criteria.
The catalog lists the vulnerability’s use in ransomware campaigns as unknown. Viewing Ray solely as a batch-job library underestimates the attack surface: its dashboard and jobs interface often run alongside the cluster without login.
Definition · Ray
Ray is an open-source Python framework for distributed computing. Teams use it to manage AI and batch jobs across clusters. Its dashboard accepts jobs through an HTTP API.
Firefox and Safari bypass the User-Agent filter
Ray long left critical endpoints such as the Jobs API unauthenticated. Its browser protection rejected requests whose User-Agent began with Mozilla. GitHub advisory GHSA-q279-jhrf-cc6v explains why this fails: Firefox and Safari allow the Fetch API to set a different User-Agent value.
Combined with DNS rebinding, the browser becomes a bridge. A crafted page or malicious display ad triggers the request while Ray runs locally or on a neighbouring network. The proof of concept (PoC) targets port 8265, the dashboard default. It then submits a job with an arbitrary entrypoint. Chrome does not implement this part of the Fetch specification and is therefore unaffected.
The advisory describes two attack paths. First, a developer’s machine running Ray as a test head node. Second, neighbouring instances behind the firewall that the browser reaches as a confused deputy. Avi Lumelsky of Oligo described the Fetch bypass. Jonathan Leitschuh, then at Socket, contributed DNS rebinding, the PoC and disclosure.
The patch fixes the filter and adds token authentication
Ray versions below 2.52.0 are affected. The fix is available in 2.52.0 and commit 70e7c72. The same release introduces token authentication, disabled by default. Updating without enabling the token fixes the browser filter but leaves the Jobs API accessible without login.
The vendor documents token authentication under Ray Security. According to the advisory, browser protections against DNS rebinding, such as Chrome’s Local Network Access, provide another defensive layer. An earlier initiative called Private Network Access was withdrawn. Updating therefore remains the reliable defence.
Immediate risk
A developer with a local Ray dashboard can be tricked into running attacker-controlled code through Firefox or Safari and DNS rebinding once a crafted page rewrites the User-Agent.
The 20 August deadline binds only US agencies
BOD 26-04 requires FCEB agencies to promptly remediate KEV vulnerabilities in publicly exposed assets that grant full access after exploitation. A local Ray development dashboard often falls outside this category. Ray controlling a data-centre cluster falls within it once the dashboard or Jobs API is network-accessible.
German operators face no CISA deadline. NIS-2 and the German Federal Office for Information Security Act (BSIG) require proportionate measures and reporting channels. The KEV Catalog still helps prioritise work: active exploitation takes precedence over the Common Vulnerability Scoring System (CVSS). Operators running Ray clusters for training or inference should give inventory and accessibility checks the same priority as those for VPN appliances on the KEV list.
Ray inventory, port 8265 and job traces
First, check the version: according to the advisory, every version below 2.52.0 is vulnerable. Then assess exposure: where the dashboard runs and which networks can reach port 8265. Include developer laptops in the same inventory as GPU nodes.
After updating, job metadata provides the trail. Unknown entrypoints, empty runtime environments and submissions outside working hours offer the simplest clues. CISA requires US agencies to conduct precisely this forensic review before closing the ticket. Without Jobs API logs, only the version update remains.
Immediate actions
- ✓Check the Jobs API for unknown entrypoints since the last update
- ✓Patch all Ray instances below 2.52.0
- ✓Keep dashboard port 8265 inaccessible from the network
- ✓Enable token authentication as documented by the vendor
If prior API use is uncertain, isolate the head node, retrieve the job history and only then patch. Updating without investigating closes the flaw and erases the evidence.
Frequently asked questions
Each question is collapsed. Tap to reveal the answer.
Does the flaw only affect developer laptops?
No. The advisory describes both local test head nodes and neighbouring Ray instances the browser can reach on the internal network.
Why is Chrome unaffected?
Chrome does not implement this part of the Fetch specification. Firefox and Safari allow Fetch to set the User-Agent. The advisory explicitly states this.
Is updating to version 2.52.0 enough?
The release fixes the inadequate browser filter. Token authentication remains off by default. Clusters with a reachable Jobs API also need the token enabled.
Does the 20 August deadline apply in Germany?
No. The due date applies to FCEB agencies under BOD 26-04. German operators face no CISA deadline but face the same exploitation threat.
How can I spot exploited Ray jobs?
Look for unknown entrypoints in the Jobs API, submissions outside normal hours and metadata no team has claimed. CISA’s brief alert lists no indicators of compromise (IoCs).
Editor’s Picks
Editor’s PickMicrosoft Teams: Android Path Traversal Runs Attacker CodeEditor’s PickBOD 26-04: Prioritizing KEV and EPSS CorrectlyEditor’s PickLoadMaster in the KEV List: Patch Has Been Available Since June
More from the MBF Media Network
cloudmagazinAWS lets an AI agent join incident investigationsMyBusinessFutureBSI and TÜV: AI attacks hit one in six firmsDigital ChiefsCRA forces manufacturers to report within 24 hours
Image source: AI-generated (August 2026)
Translated from the German original using artificial intelligence. The German version is authoritative.
