Ray Is Being Exploited: AI Teams Should Check Development Systems Now

What happened, who is affected and what should teams do now?

On 17 August 2026, the US Cybersecurity and Infrastructure Security Agency added CVE-2025-62593 to its Known Exploited Vulnerabilities catalogue. The flaw affects Ray, a distributed-computing platform widely used to train, test and operate AI and machine-learning workloads.

Ray versions earlier than 2.52.0 are affected. A developer running Ray may have commands executed on their machine after visiting a malicious webpage in Firefox or Safari. The practical impact can include data loss, code modification or use of the workstation as a route into the internal network.

AI teams should check Ray versions now, upgrade to a current release with 2.52.0 as the minimum fixed version, enable token authentication and ensure the dashboard is no more exposed than necessary.

“It only runs on a developer machine” is not a safe exception: the user’s browser can become the path into a local Ray service.

How can a webpage reach Ray on a local system?

Ray provides a dashboard and APIs that accept jobs. Those endpoints are designed to execute submitted work, so an unauthorised request may lead to command execution rather than merely exposing information.

Older releases used a User-Agent check to guess whether a request came from a browser. A User-Agent is simply a label attached to a request. Firefox and Safari allow webpages to change that label in the relevant situation, making the protection unreliable.

The attacker also uses DNS rebinding. In plain terms, a hostname first points to an attacker-controlled system and is then redirected to a local address. The browser becomes a bridge to a Ray service that would not normally be visible from the internet.

What has been confirmed?

CISA says there is evidence of exploitation and has placed the issue in KEV, a catalogue of vulnerabilities observed in real attacks. That signal is stronger than a proof of concept or a forecast of possible exploitation.

Public information does not currently identify victims, campaign size or a specific threat actor. Evidence of exploitation does not mean that every old Ray cluster has been compromised.

Ray disclosed the issue in November 2025 and fixed it in 2.52.0. On 19 August 2026, Anyscale confirmed the KEV listing and advised teams still below 2.52.0 to upgrade.

A checklist for today

Do not limit the review to production clusters. This flaw targets development environments, which often receive less monitoring while still holding credentials, sample data and connections to other systems.

• ✓Check the installed version and review requirements files, lockfiles, container images and long-lived notebooks.
• ✓Upgrade to a current Ray release; 2.52.0 is the minimum version containing the CVE-2025-62593 fix.
• ✓Enable token authentication for the dashboard, Job Submission and Ray Client; upgrading alone does not automatically enable it.
• ✓Find dashboard configurations that listen on every interface, such as `--dashboard-host=0.0.0.0`, and restrict them to loopback or a trusted management network unless wider access is required.
• ✓Include developer machines, development containers, CI runners, notebook servers, test clusters and contractor environments.
• ✓For systems that were exposed or remained on an affected release, review unfamiliar Ray jobs, processes, file changes and network activity before declaring them clean.

Is upgrading enough?

Upgrading applies the direct fix. Ray also recommends token authentication and a controlled network perimeter. These layers complement each other: the new release fixes the known bug, the token blocks requests without the secret and segmentation reduces who can reach the service.

Using Chrome should not be treated as remediation. The published chain focuses on Firefox and Safari, but depending on one browser behaviour is not a durable security control.

Where Friday Works can help

Friday Works can help map AI dashboards, APIs, notebooks and environments; review exposure; assess authentication and authorisation; trace paths from web interfaces into internal systems; and retest after upgrades.

Ray upgrades and infrastructure response still require coordination with the team responsible for the cluster. The assessment scope should state which environments were checked and what evidence was retained.