All posts
Unproven Execution

Ray Jobs API: Localhost Is Not a Trust Boundary

CISA added CVE-2025-62593 to KEV on August 17 — DNS rebinding turns a Firefox tab into arbitrary code execution against a developer running Ray locally

Securityv0 Intelligence Team OWASP: ASI05 sv0 finding: unproven_execution
unproven-execution ray cisa-kev dns-rebinding ai-training agent-security

The Incident

On August 17, 2026, CISA added CVE-2025-62593 to the Known Exploited Vulnerabilities catalog and set a Federal Civilian Executive Branch remediation deadline of August 20, 2026. The flaw is a browser-reachable remote code execution vulnerability in the Ray AI framework’s Jobs API — the /api/jobs/ and /api/job_agent/jobs/ endpoints that ship listening on the developer’s loopback interface. CVSS is 9.4 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H); every Ray release before 2.52.0 is affected and 2.52.0 carries the fix. The vulnerability was publicly disclosed on November 26, 2025 and credited to Avi Lumelsky of Oligo Security for the browser bypass and to Jonathan Leitschuh of Socket for the DNS-rebinding chain.

The exploit needs no exposed cluster and no stolen credential. When a developer running Ray on their workstation visits an attacker-controlled page in Firefox or Safari, the page rebinds its own hostname to 127.0.0.1, then issues same-origin fetch() requests to the local Ray Jobs endpoint with the User-Agent header rewritten to a non-Mozilla string. That single header field was Ray’s only guard against browser-originated requests — Firefox and Safari let script code overwrite it, while Chrome’s stricter posture accidentally provides cover. The POST body is an arbitrary Python payload, which Ray schedules and executes with the developer’s own privileges. BitSight reported in March 2026 that the RondoDox DDoS botnet had incorporated the exploit two days before public disclosure — but its operator hardcoded the User-Agent as Mozilla/5.0 (rondo2012@atomicmail[.]io), which trips Ray’s startsWith("Mozilla") check and renders the payload inert. CWE-94 (Code Injection) and CWE-352 (CSRF) are both assigned.

MITRE ATT&CK coverage: T1189 Drive-by Compromise, T1059.006 Command and Scripting Interpreter: Python.

The Authority Path That Failed

The identity that carried execution authority at the moment of failure was the local Ray Jobs API endpoint listening on the developer’s workstation, running as the developer’s own OS user. Its held scope is total by design — the Jobs API exists to accept arbitrary Python payloads and execute them on the local cluster. Its exercised scope in this incident was identical in mechanism, but the submitter was a cross-origin JavaScript payload in the developer’s browser rather than the developer. The gap between held and exercised is not a memory bug, an injection flaw, or a missed patch; it is a design decision Ray shipped in 2023 and continues to ship in 2025: nothing binds a specific identity to submission rights on that endpoint.

The trust anchor that failed first was positional. Ray treated “reachable at localhost” as equivalent to “authorized by the operator,” and bolted a User-Agent starts-with-Mozilla heuristic on top to distinguish CLI/SDK traffic from browser traffic. DNS rebinding demolishes the localhost assumption because the attacker’s HTTP origin resolves to localhost after the second DNS query; the browser is now making same-origin requests to Ray from a page it can fully script. Anyscale’s response to the older CVE-2023-48022 was to categorize the missing-auth Jobs API as an intentional design choice premised on running Ray in an isolated network. CVE-2025-62593 falsifies that premise — the loopback interface is the exposure, and a two-line JavaScript change in an attacker’s page is the exploit. Ray 2.52.0 acknowledges the underlying problem by adding built-in token authentication across the dashboard, CLI, API, and internal services — but ships it opt-in behind RAY_AUTH_MODE=token, tracked separately as CVE-2025-34351. An operator who upgrades to 2.52.0 without setting that variable inherits the DNS-rebinding hardening but not the identity binding.

SecurityV0 Perspective

This maps to unproven_execution (ASI05). The same authority pattern that shipped Langflow’s CSV Agent wired to a Python REPL — a code-execution capability attached to a service without an explicit operator authorization gate — is present in every Ray installation older than 2.52.0, and in every 2.52.0-or-newer installation that has not opted into token auth.

Security teams need to know which developer workstations and CI runners expose a Ray Jobs API, whether token authentication is enabled, and which cloud, source-control, or cluster credentials a browser-triggered Python payload could reach. Network position cannot prove who authorized code execution. The control belongs on the endpoint: bind each submission to an authenticated identity and enforce the authority granted to it.

What To Do

  • Upgrade Ray to 2.52.0 on every developer workstation and CI runner, and set RAY_AUTH_MODE=token in your default configuration. The version bump alone hardens the DNS-rebinding origin check, but token auth is opt-in — an upgrade without the environment variable leaves the identity-binding gap that CVE-2025-34351 documents. Bake both into your base images and pin the minimum version in every requirements file.
  • Inventory every host answering a Ray Jobs API on 127.0.0.1:8265 or another bind address. Record the Ray version and verify token authentication through configuration and an authenticated test. Do not infer protection from one User-Agent probe; version, origin hardening, and authentication are separate controls.
  • Block DNS answers from external resolvers that point back at loopback or RFC1918 space in the workstation and runner DNS path. Enable rebinding protection in dnsmasq, unbound, or your endpoint DNS agent; the stop-dns-rebind / private-address options refuse to serve answers where a public DNS name resolves to 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16. This is a generic control that neutralizes the exploit vector for Ray and every other localhost-trusting service.
  • Investigate exposed hosts and rotate credentials when evidence indicates exploitation. Review Ray job history, process execution, browser activity, and endpoint telemetry. If suspicious execution occurred, revoke and reissue reachable cloud credentials, GitHub PATs, Hugging Face tokens, and cluster kubeconfigs.
  • Treat the Ray CVE-2023-48022 / ShadowRay lineage as a live baseline, not a fixed story. Oligo’s ShadowRay 2.0 write-up (November 2025) attributes ongoing GPU-cluster cryptomining to actor IronErn440 exploiting the older missing-auth Jobs API on Internet-exposed clusters; CVE-2025-62593 extends the same authority defect to hosts that were never Internet-exposed. Sweep every Ray dashboard reachable from your public perimeter, and treat unexplained XMRig or new job submissions as compromise, not misconfiguration.

Sources

All posts