Read the docs
TI-2025-38808 Aliases CVE-2025-62593GHSA-q279-jhrf-cc6v

Ray is vulnerable to RCE via Safari & Firefox Browsers through DNS Rebinding Attack

Priority CRITICAL 100Exploited in the wildCWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Tampering, Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 4 fixed, 1 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-352 and CWE-94.

Summary

Ray is an AI compute engine. Prior to version 2.52.0, developers working with Ray as a development tool can be exploited via a critical RCE vulnerability exploitable via Firefox and Safari. This vulnerability is due to an insufficient guard against browser-based attacks, as the current defense uses the User-Agent header starting with the string "Mozilla" as a defense mechanism. This defense is insufficient as the fetch specification allows the User-Agent header to be modified. Combined with a DNS rebinding attack against the browser, and this vulnerability is exploitable against a developer running Ray who inadvertently visits a malicious website, or is served a malicious advertisement (malvertising). This issue has been patched in version 2.52.0.

Why it matters now

Exploitation Active In CISA KEV since 2026-08-17CISA due date 2026-08-20
EPSS 0.6015 99th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial ray (ray-project): 2.52.0ray (PyPI): 2.52.0Red Hat: 10 advisoriesRed Hat: 4 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Ray-Projectraybefore 2.52.02.52.0Patch availableCNA
—ray (PyPI)before 2.52.02.52.0Patch availableGHSA-q279-jhrf-cc6v
  • ray VendorRay-Project Affected before 2.52.0 Fixed in 2.52.0 Patch available CNA
  • ray (PyPI) Vendor— Affected before 2.52.0 Fixed in 2.52.0 Patch available GHSA-q279-jhrf-cc6v

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:anyscale:ray:*:*:*:*:*:*:*:*before 2.52.0VulnerableAnyscale, Inc
  • cpe:2.3:a:anyscale:ray:*:*:*:*:*:*:*:* Versions before 2.52.0 Vulnerable ·Anyscale, Inc

Remediation

  • Fix · CNA ray (ray-project) Fixed in 2.52.0
  • Fix · GHSA-q279-jhrf-cc6v ray (PyPI) Fixed in 2.52.0 Advisory →

Red Hat 10 advisories

  • RHSA-2026:61627 Released 2026-08-31 · Red Hat rating Important
    Red Hat AI Inference Server 3.2.2 (CUDA)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-cuda-rhel9
  • RHSA-2026:3713 Released 2026-03-04 · Red Hat rating Critical
    RHOAI 3.3 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +47
  • RHSA-2026:3462 Released 2026-02-27 · Red Hat rating Critical
    Red Hat AI Inference Server 3.2.2 (ROCm)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-rocm-rhel9
Show 7 more Red Hat advisories
  • RHSA-2026:3461 Released 2026-02-27 · Red Hat rating Critical
    Red Hat AI Inference Server 3.2.2 (CUDA)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-cuda-rhel9
  • RHSA-2026:1027 Released 2026-01-22 · Red Hat rating Important
    RHOAI 3.2 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-guardrails-detector-huggingface-runtime-rhel9, registry.redhat.io/rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9 +10
  • RHSA-2025:23531 Released 2025-12-17 · Red Hat rating Important
    RHOAI 2.25.1 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9 +34
  • RHSA-2025:23204 Released 2025-12-15 · Red Hat rating Important
    Red Hat AI Inference Server 3.2.5 (CUDA)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-cuda-rhel9
  • RHSA-2025:23080 Released 2025-12-10 · Red Hat rating Important
    Red Hat AI Inference Server Model Optimization Tools 3.2.2 (CUDA)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/model-opt-cuda-rhel9
  • RHSA-2025:23079 Released 2025-12-10 · Red Hat rating Important
    Red Hat AI Inference Server 3.2.2 (ROCm)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-rocm-rhel9
  • RHSA-2025:23078 Released 2025-12-10 · Red Hat rating Important
    Red Hat AI Inference Server 3.2.2 (CUDA)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-cuda-rhel9

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat AI Inference Server 3.2Fixed RHSA-2025:23078, RHSA-2025:23079, RHSA-2025:23080, RHSA-2025:23204, RHSA-2026:3461, RHSA-2026:3462, RHSA-2026:61627
Red Hat OpenShift AI 2.25Fixed RHSA-2025:23531
Red Hat OpenShift AI 3.2Fixed RHSA-2026:1027
Red Hat OpenShift AI 3.3Fixed RHSA-2026:3713
Not affected: 5 products
  • Red Hat Enterprise Linux AI (RHEL AI) 3
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 2.25
  • Red Hat OpenShift AI 3.2
  • Red Hat OpenShift AI 3.3

Timeline

  1. 2026-08-17 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2025-62593
  3. 2026-10-03 Alias added: GHSA-q279-jhrf-cc6v

References

Exploit 1

Patch 1

Advisory 2

Other 6

  • TI-2023-05545 Ray Command Injection in cpu_profile Parameter CVSS 3.1CRITICAL 9.8
  • TI-2026-25429 Ray Dashboard <= 2.8.0 Path Traversal Leading to Local File Disclosure CVSS 4.0HIGH 8.7
  • TI-2023-05547 Ray Log File Local File Include CVSS 3.1HIGH 7.5
  • TI-2026-21889 Ray: Dashboard DELETE endpoints allow unauthenticated browser-triggered DoS (Serve shutdown / job deletion) CVSS 3.1MEDIUM 6.5
  • TI-2023-05546 Ray Static File Local File Include CVSS 3.1HIGH 7.5
  • TI-2026-30073 Ray: Remote Code Execution via Parquet Arrow Extension Type Deserialization CVSS 4.0HIGH 8.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences