Ray RCE on CISA's KEV list: localhost is not a boundary

The scariest thing about this bug is not the CVSS score. It's the attack path. CVE-2025-62593 is a Ray RCE that fires when a developer running Ray locally visits a web page — a phishing link, or an ordinary ad on an ordinary site. No open port on the internet. No stolen credential. CISA moved it to the Known Exploited Vulnerabilities catalog on August 17, 2026 and gave federal agencies three days to patch. If your team runs Ray anywhere, the fix is version 2.52.0 or later, and the deadline was yesterday.

What actually happened

Ray is the distributed compute framework under a large share of Python ML workloads. It started at UC Berkeley, was commercialized by Anyscale, and now sits under the Linux Foundation's PyTorch Foundation.

The flaw is in how Ray's HTTP API defended itself against browsers. Per the ray-project security advisory, the guard checked whether the incoming User-Agent header started with Mozilla — the assumption being that a real browser can't be made to talk to a local API in a dangerous way. Firefox and Safari let scripts rewrite that header through the Fetch API. Combine the rewrite with a DNS rebinding attack and a page you visit can reach /api/jobs and /api/job_agent/jobs/ on your own machine and submit a job. A Ray job is arbitrary code. That's the whole chain.

The vendor rates it 9.4 under CVSS 4.0. It was disclosed in November 2025 and fixed in Ray 2.52.0. CISA changed its assessment from "proof of concept exists" to "actively exploited" on August 17, 2026, with a remediation deadline of August 20 under BOD 26-04, per The Hacker News. That reporting also notes the RondoDox botnet had the exploit two days before public disclosure, and that the ShadowRay 2.0 campaign has been mining cryptocurrency on unpatched GPU clusters.

The advisory adds one more detail worth sitting with: the browser can be used as a confused deputy to reach Ray instances elsewhere on a private corporate network — not just the one on the laptop.

Why a browser-reachable Ray RCE matters for your business

"It's only bound to 127.0.0.1" stopped being a security control. Every AI tool in this category — Ray, Jupyter, model servers, MCP servers, local agent runtimes — ships a convenient localhost HTTP API with weak or no auth, because the quickstart has to be pleasant. The browser sitting on the same machine is a fully programmable HTTP client that an attacker controls remotely. Treat any localhost API as internet-adjacent, because through the browser, it is.

Your dev laptops hold more than your servers do. The machine running that Ray job also has your cloud CLI session, your model API keys in a dotfile, and a git credential helper with push access. RCE there is not a lab incident. If you ran an unpatched Ray on a machine with real credentials, rotate them — cloud keys, LLM keys, git tokens — and stop reasoning about whether the specific exploit was aimed at you.

A ten-month-old fix means your inventory is the real problem. The patch existed since November 2025. What changed this week is that attackers got busy. Anything you can't enumerate, you can't patch on someone else's timeline. Pin Ray in your lockfiles, rebuild base images that still carry an old version, and turn on token auth on any Ray dashboard or job submission endpoint you actually need running.

Sources: ray-project security advisory, The Hacker News.