CISA added CVE-2025-62593 to its Known Exploited Vulnerabilities catalog after confirming the flaw is being actively abused in the wild. The affected software is Ray, an open-source Python framework widely used to distribute AI and machine learning workloads — the project has more than 43,500 GitHub stars and is common in ML research and production pipelines. The vulnerability scores 9.4 on CVSS and enables remote code execution via a DNS rebinding attack launched from a web browser. An attacker tricks a developer into visiting a malicious page (through phishing or a poisoned ad), and the browser — acting as an unwitting proxy — issues API calls to the Ray instance running on the developer’s own machine. Because Ray’s critical API endpoints like /api/jobs have no authentication at all, those requests succeed and can execute arbitrary shell commands.
The risk is highest for developers running Ray locally during testing or development. Ray’s project maintainers noted that the attack can be extended beyond the developer’s own machine: if the Ray instance is reachable inside a corporate network, the browser-as-confused-deputy technique can target other network-adjacent Ray nodes as well. The maintainers have long been aware that Ray’s lack of authentication is a design decision, not an oversight, but CISA’s KEV listing means federal civilian agencies must remediate the flaw on a mandatory timeline, and the active exploitation evidence makes it urgent for anyone else running Ray too.
How to check if you’re affected
Affected versions are all Ray releases that expose the dashboard or job submission API without authentication — check whether Ray is running on your development machine with ray status or by visiting http://localhost:8265 in a browser. If you see the Ray dashboard, your installation is reachable and potentially vulnerable. Apply the latest available Ray patch or restrict the dashboard port to localhost-only with a firewall rule. The CISA KEV entry deadline for federal agencies is September 8, 2026.