US cyber agency flags actively exploited flaw in Ray, the AI developer tool

CISA has added a vulnerability in Ray, the open-source AI compute engine, to its Known Exploited Vulnerabilities catalogue, meaning US federal agencies must patch it by 20 August 2026. The flaw, tracked as CVE-2025-62593, lets an attacker remotely hijack a developer’s machine, but only in fairly specific circumstances.

What the bug actually does

Ray is used by developers and ML engineers to build and run distributed AI applications, and it ships with tools meant for local development rather than public-facing production use. According to NVD, versions before 2.52.0 tried to stop browser-based attacks by checking that incoming requests carried a User-Agent header starting with “Mozilla” — on the assumption that a malicious script couldn’t fake that string.

That assumption turns out to be wrong. The web’s fetch specification allows sites to modify the User-Agent header, so the check is trivial to get around. Chain that with a DNS rebinding attack — a well-known technique for tricking a browser into treating an external server as if it were on your local network — and an attacker can reach into a developer’s machine running Ray and execute code on it.

The catch is that it only works against Firefox and Safari, and only if the developer visits a booby-trapped website or is served a malicious advert (malvertising) while Ray is running locally. GitHub, which assigned the CVE, rates it 9.4 out of 10 under CVSS 4.0 — critical. NVD’s own CVSS 3.x scoring puts it slightly lower, at 8.8, still comfortably in “high severity” territory. CISA’s addition to the KEV catalogue confirms this isn’t theoretical: someone, somewhere, has already exploited it in the wild, though CISA does not say who or how many.

So who is actually at risk

This is not a consumer issue. There’s no evidence here of ordinary users, gamers or anyone running an app or website being affected. The people exposed are developers and data scientists running Ray locally as a development tool — typically on their own laptop or workstation, with the Ray dashboard and its associated services listening for connections. If that’s you, and you use Firefox or Safari for your daily browsing while Ray is running, you’re the target audience for this bug. Everyone else can carry on as normal.

CISA’s KEV listing is aimed squarely at US government agencies, which face a hard deadline to patch or mitigate. It’s not a UK regulatory requirement, but the KEV catalogue is widely treated as a reliable signal across the security industry that a vulnerability is being actively abused, not just sitting in a lab write-up.

What to do about it

The fix is straightforward: update Ray to version 2.52.0 or later, where the flawed User-Agent check has been removed in favour of a proper defence. If you’re running an older version and can’t upgrade immediately, avoid running Ray’s development server while browsing the open web in Firefox or Safari, and consider Chrome-based browsers or a locked-down profile in the meantime as a stopgap, not a permanent fix.

The takeaway

This is a real, actively exploited vulnerability, but it’s a narrow one: it hits developers running Ray locally in specific browsers, not the wider public. If that describes your setup, patch now. If it doesn’t, there’s nothing here that changes your Tuesday.