← back
CVE-2025-62593criticalunder attackCWE-352CWE-94

Ray is vulnerable to RCE via Safari & Firefox Browsers through DNS Rebinding Attack

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.4epss 62%
from disclosure to weapon265 days
Published on NVDNov 26
1st PoC+265d
CISA KEV+264d
exploitation probability
62%top 1% of all CVEs
observed exploitation
yesCISA + VulnCheck
1 public exploit(s)
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Affected
1 product
Red Hat OpenShift AI (RHOAI)
workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Fixed
4 products (51 components)
Red Hat OpenShift AI 3.2 · Red Hat OpenShift AI 2.25 · Red Hat AI Inference Server 3.2 · Red Hat OpenShift AI 3.3
Not affected
5 products (628 components) — because the vulnerable code is not present in the product
Red Hat OpenShift AI 3.3 · Red Hat OpenShift AI 3.2 · Red Hat OpenShift AI 2.25 · Red Hat Enterprise Linux AI (RHEL AI) 3 · Red Hat OpenShift AI (RHOAI)
Action required by CISAfederal deadline: 2026-08-20

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

In short

Ray's development server can be compromised when a developer visits a malicious website, due to weak browser security checks. An attacker uses DNS tricks and fake browser headers to run harmful code on the developer's machine.

Technical detail

CVE-2025-62593 exploits insufficient CSRF protection in Ray's web interface by bypassing User-Agent validation through header spoofing combined with DNS rebinding attacks. The attack vector targets developers running Ray locally who visit attacker-controlled sites; successful exploitation allows arbitrary code execution with the privileges of the developer's session. Affected versions prior to 2.52.0 lack proper SameSite cookie enforcement and origin validation.

Summary generated and translated by AI from the official description.
Ray is an AI compute engine. Prior to version 2.52.0, developers working with Ray as a development tool can be exploited via a critical RCE vulnerability exploitable via Firefox and Safari. This vulnerability is due to an insufficient guard against browser-based attacks, as the current defense uses the User-Agent header starting with the string "Mozilla" as a defense mechanism. This defense is insufficient as the fetch specification allows the User-Agent header to be modified. Combined with a DNS rebinding attack against the browser, and this vulnerability is exploitable against a developer running Ray who inadvertently visits a malicious website, or is served a malicious advertisement (malvertising). This issue has been patched in version 2.52.0.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Affected products
ray-project · ray
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.