Ray AI Compute Engine DNS Rebinding Remote Code Execution Vulnerability (CVE-2025-62593)

1. Official Patch Application (Recommended)

Upgrade your Ray framework to the patched version (2.52.0 or higher).

# If using pip
pip install --upgrade ray>=2.52.0

# Update your requirements.txt or pyproject.toml
ray>=2.52.0

2. Temporary Mitigations

If an immediate upgrade is not feasible:

• Network Isolation: Restrict the Ray dashboard and API services to bind only to localhost (--host 127.0.0.1) and avoid exposing them to broader networks.
• DNS Rebinding Protection: Use secure DNS servers or local router configurations that block external DNS responses containing private/loopback IP addresses (RFC 1918 filtering).

A critical Remote Code Execution (RCE) vulnerability has been identified in the Ray AI compute engine. This vulnerability stems from an insufficient defense mechanism designed to guard against browser-based attacks.

Ray previously attempted to block unauthorized browser requests by validating if the User-Agent header started with the string "Mozilla". However, this defense is fundamentally flawed because the Fetch specification allows the User-Agent header to be manipulated or bypassed under certain conditions.

By combining this bypass with a DNS Rebinding attack, an attacker can exploit a developer running Ray locally. If the developer inadvertently visits a malicious website or is served a malicious advertisement (malvertising), the attacker's domain rebinds to the developer's localhost IP. This allows the browser to bypass the Same-Origin Policy (SOP) and send arbitrary API requests to the local Ray instance, leading to arbitrary code execution (CWE-94, CWE-352). This vulnerability is actively exploited in the wild and is listed in the CISA KEV catalog.