Ray AI Dashboard RCE Exploited via DNS Rebinding: Patch Now (CVE-2025-62593)

Security researchers at Bitsight have observed the RondoDox botnet attempting to exploit a critical vulnerability in Ray, a widely used open-source AI compute engine, while the U.S. Cybersecurity and Infrastructure Security Agency has flagged the flaw as actively exploited. The bug — CVE-2025-62593 — allows a malicious website or malicious advertisement to run arbitrary commands on a developer's machine simply because that developer used Firefox or Safari while running Ray's dashboard.

What Happened

Ray is an AI compute engine used by developers, data scientists, and machine-learning teams to build and scale workloads. Its dashboard service, typically running on port 8265, manages jobs and exposes critical REST endpoints. Prior to version 2.52.0, those endpoints had no authentication and relied on a weak browser filter.

The vendor advisory, GHSA-q279-jhrf-cc6v, and commit 70e7c72780bdec075dba6cad1afe0832772bfe09 both describe the same root cause. The fix shipped in Ray 2.52.0. CISA added the flaw to the Known Exploited Vulnerabilities catalog on August 17, 2026, marking active exploitation.

Understanding the Vulnerability

At its core, this is a missing authentication issue. Ray's job submission endpoints — /api/jobs and /api/job_agent/jobs/ — accepted unauthenticated POST and PUT requests. The only defense was a middleware check that rejected requests whose User-Agent header started with Mozilla. The Fetch specification allows Firefox and Safari to set an arbitrary User-Agent header from JavaScript, so an attacker can make a browser-generated request look like a non-browser request. Attackers can combine that bypass with a DNS-rebinding technique to force a developer's browser to send the malicious job request to the internal Ray dashboard.

The vulnerable components are:

• Ray dashboard HTTP service, default port 8265
• /api/jobs endpoint
• /api/job_agent/jobs/ endpoint

The root cause is a trust boundary based on mutable request metadata. The dashboard's browsers_no_post_put_middleware and the deny_browser_requests decorator relied solely on the User-Agent header beginning with Mozilla. Modern browsers automatically include Sec-Fetch-* headers on browser-initiated requests, but the vulnerable code did not check for those headers.

Attack chain according to the advisory and public proof-of-concept:

1. An attacker hosts a malicious web page, or buys malvertising inventory. The page uses a DNS-rebinding toolkit such as NCCGroup Singularity.
2. A developer running Ray visits the page in Firefox or Safari. DNS rebinding makes the browser resolve the attacker-owned domain first to the attacker server, then to the internal address of the Ray dashboard.
3. The page sends a POST request to the internal Ray dashboard, with the User-Agent header set to a non-Mozilla value such as Other.
4. The request body contains a malicious entrypoint field, which is the shell command the Ray worker will execute.
5. Because the endpoint has no authentication and the modified User-Agent bypasses the Mozilla check, Ray accepts the job and executes the command, giving the attacker arbitrary code execution.

1{
2  "entrypoint": "open -a Calculator"
3}

The public proof-of-concept launches the calculator as a harmless demonstration, but an attacker could use any shell command.

The patch, commit 70e7c72780bdec075dba6cad1afe0832772bfe09 included in Ray 2.52.0, adds a has_sec_fetch_headers() check. All major browsers automatically add Sec-Fetch-* headers to browser-initiated requests, so rejecting any request that carries them closes the bypass. Ray 2.52.0 also introduced optional token-based authentication. That token authentication is disabled by default, which is why upgrading remains essential.

Who Is Affected

Affected components include the Ray dashboard HTTP server, /api/jobs endpoint, /api/job_agent/jobs/ endpoint, and the default dashboard port 8265. The advisory targets development and test environments. The impact on production Ray clusters that already enforce authentication is not fully documented, but those environments should still be patched.

Ray users are typically AI developers, data scientists, and machine-learning engineers. A compromised developer workstation can expose source code repositories, API keys, credentials stored in environment variables, internal network topology information, and any data the developer can access.

Real-World Risk

The CISA ADP Vulnrichment assessment lists exploitation as active, automatable yes, and technical impact total. CISA added CVE-2025-62593 to the Known Exploited Vulnerabilities catalog on August 17, 2026.

BitSight reported in its RondoDox botnet infrastructure analysis that the botnet attempted to use this flaw on November 24, 2025. In that observed campaign, the exploit code used an incorrect User-Agent value and was ineffective. However, the attempt shows automated interest. Public proof-of-concept code exists in the NCCGroup Singularity repository and in the vendor advisory.

Known threat actors and campaigns:

• RondoDox botnet — observed attempting exploitation, albeit with a malformed User-Agent
• Unattributed actors using NCCGroup/Singularity DNS-rebinding tooling
• Public DNS-rebinding demonstration campaigns

No confirmed successful wild exploitation has been documented, but CISA's active exploitation designation and the observed botnet attempt warrant urgent remediation.

Worst-case impact is full system compromise. Attackers can steal source code, API keys, developer credentials, and environment variables. They can pivot into internal corporate networks, compromise CI/CD pipelines, inject backdoors, exfiltrate data, and cause intellectual property loss or regulatory breach.

Official CVSS v4.0 score: 9.4 Critical, vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H. Some third-party analyses estimated 9.8 under CVSS v3.1, but the official CNA score is the 9.4 CVSS v4.0 metric.

What You Should Do

1. Immediately upgrade all Ray installations to version 2.52.0 or later.
2. Enable token-based authentication for the dashboard and job APIs. It is disabled by default, so enabling it requires configuration of tokens and may affect existing scripts that rely on unauthenticated access.
3. Restrict dashboard network exposure to trusted internal subnets or VPN only. Do not expose the Ray dashboard to the public internet. Operational impact may occur if remote debugging is needed.
4. Deploy detection rules for anomalous job submissions.
5. Educate developers about the risk of visiting untrusted sites or being served malicious ads while a Ray node is running.
6. Consider adding a reverse proxy that enforces strict SameSite and CSRF checks for dashboard endpoints.

Workarounds if patching is delayed:

Detection recommendations and indicators of compromise:

• POST or PUT requests to /api/jobs or /api/job_agent/jobs/ with a non-Mozilla User-Agent header.
• Presence of Sec-Fetch-* headers on job-submission requests.
• Job submissions whose entrypoint field contains shell commands such as calc.exe, open -a Calculator, gnome-calculator, wget, or rm -rf.
• Unexpected process creation of calculator or other binaries shortly after a job submission.
• Ray dashboard logs recording a job_submission_id matching timestamps of suspicious web activity.
• aiohttp access logs showing 405 Method Not Allowed for browser traffic bypassed.
• DNS query logs showing rapid TTL changes for a domain that resolves to an internal IP.

Deploy the following detection rules:

• Sigma rule: Ray Dashboard Job Submission With Non-Mozilla UA — looks for HTTP POST to /api/jobs where User-Agent does not match ^Mozilla.
• YARA rule for log files: detect the string You need to enable JavaScript in the response body combined with a subsequent job creation event.
• Custom YARA rule to detect the public proof-of-concept JavaScript payload.

The Bigger Picture

This vulnerability is a reminder that the User-Agent header is client-controlled and mutable, and that authentication cannot be replaced by browser heuristics. DNS rebinding remains an underappreciated technique for reaching localhost services, and AI/ML development tools are high-value targets because they hold source code, credentials, and compute resources.

The fix demonstrates the value of Sec-Fetch-* headers as a secondary browser request signal. Organizations should also treat any local development dashboard as a potential bridge from the browser into the host operating system.

With public proof-of-concept code available and automated exploitation attempts already observed, copycat activity is likely. CISA KEV inclusion means U.S. federal agencies are required to remediate, but every organization running Ray should treat CVE-2025-62593 as an urgent patch priority.