What is the actual attack?

You visit a web page while Ray is running. The page uses DNS rebinding to reach the Ray dashboard or API on your own machine, and the dashboard's browser protection — a check that the User-Agent starts with "Mozilla" — does not stop it. From there the attacker can execute code.

Which version fixes it?

Ray 2.52.0. Versions before that are affected.

Why does the deadline say August 20 if I am not a federal agency?

The August 20 date is CISA's binding remediation deadline for U.S. federal civilian agencies. It is not a legal deadline for anyone else, but it is a strong signal about severity: KEV listing means active exploitation, not theoretical risk.

Does it matter which browser I use?

The advisory names Firefox and Safari. Do not read that as an all-clear for anything else — read it as a reason to patch rather than to audit your browser choices.

SecurityAugust 18, 2026·2 min read·By the Automation Squad Research

CISA: Patch Ray Now, It's Being Exploited

The dashboard checked whether your User-Agent started with "Mozilla". DNS rebinding walks straight through that. Ray 2.52.0 fixes it.

By Robert MacKelfresh

Founder, Automation Squad · August 18, 2026

The short answer

CVE-2025-62593 is a critical remote code execution flaw in Ray versions before 2.52.0. The Ray dashboard and API were insufficiently protected against browser-based attacks: the defence checked whether the HTTP User-Agent header began with "Mozilla", which DNS rebinding defeats. An attacker could execute code on a developer's machine simply by getting them to visit a malicious page while Ray was running. CISA added it to the Known Exploited Vulnerabilities catalog on August 17, 2026, with a federal remediation deadline of August 20. Ray 2.52.0 contains the fix.

Exposure checkDeadline: August 20, 2026 (federal agencies)

Find out in five minutes whether this is your problem

The trap in this one is that it does not require an exposed port. It requires a browser on the same machine, or the same network, as a running Ray dashboard. Plenty of people who believe they are not exposed are.

Check the version everywhere Ray runs
Run `ray --version`, and do it on developer laptops as well as clusters. This vulnerability targets the machine with the browser on it, which makes laptops the interesting surface rather than the boring one.
Upgrade to 2.52.0 or later
That release contains the fix. Pin it in whatever file declares your dependencies, then confirm the running process actually restarted — an upgraded package with a stale process is a very common way to believe you have patched something you have not.
Do not treat 'it only listens on localhost' as mitigation
That is precisely the case this attack was built for. DNS rebinding lets a page in your browser reach a service bound to localhost, which is why the User-Agent check existed and why defeating it matters.
If you cannot upgrade today, stop the dashboard
A dashboard that is not running cannot be reached. It is a blunt mitigation and an inconvenient one, but it buys hours safely if a version bump needs a change window.
Look backwards, not just forwards
This is in the KEV catalog because it is being exploited, and it has been linked publicly to botnet activity. Check for unexpected processes and outbound connections on any machine that ran an unpatched dashboard, rather than assuming you got there first.

Situation	Are you affected?
Ray 2.52.0 or later	No. This is the fixed version.
Ray below 2.52.0, dashboard running locally	Yes — this is the main case. Local is not safe here.
Ray below 2.52.0, dashboard bound to 0.0.0.0	Yes, and worse. Fix today.
Ray below 2.52.0, dashboard never started	Reduced, not zero. Upgrade anyway.
Using Firefox or Safari on that machine	These are the browsers named in the advisory.
Managed Ray via a cloud provider	Ask the provider for their patched version and date.

CISA added CVE-2025-62593 to its Known Exploited Vulnerabilities catalog on August 17, 2026, and set August 20 as the remediation deadline for federal civilian agencies. The flaw is in Ray, the distributed compute framework a great deal of AI work quietly runs on, and it is rated critical.

The facts: Ray versions before 2.52.0 insufficiently protected the dashboard and API against browser-based attacks. The protection that existed checked whether the HTTP User-Agent header started with "Mozilla". Combined with DNS rebinding, that check can be walked through, and the result is arbitrary code execution on the machine running Ray — triggered by nothing more than visiting a malicious page or viewing a malicious advert while Ray is up. The advisory names Firefox and Safari. Ray 2.52.0 contains the fix, and the vulnerability has been publicly linked to botnet activity and to the ShadowRay 2.0 campaign.

Automation Squad's take: the detail worth sitting with is that the vulnerable surface is a developer laptop, not a hardened cluster. Most people reason about exposure in terms of open ports and public IPs, and by that reasoning a dashboard on localhost is fine. DNS rebinding exists specifically to break that reasoning, and a User-Agent string was never going to be a security boundary — it is a value the client chooses. This is also a good reminder that AI infrastructure inherited a large amount of ordinary web attack surface on the way in. Ray is a compute framework, but the thing that got exploited is a web dashboard.

Run this now: run `ray --version` on every machine that runs Ray, laptops included, and upgrade anything below 2.52.0 today. Confirm the process actually restarted rather than trusting the package version. If a change window blocks the upgrade, stop the dashboard in the meantime — that is crude, but it closes the door. Then check any machine that ran an unpatched dashboard for unexpected processes or outbound connections, because KEV listing means someone is already using this.

Questions people are asking

What is the actual attack?: You visit a web page while Ray is running. The page uses DNS rebinding to reach the Ray dashboard or API on your own machine, and the dashboard's browser protection — a check that the User-Agent starts with "Mozilla" — does not stop it. From there the attacker can execute code.
Which version fixes it?: Ray 2.52.0. Versions before that are affected.
Why does the deadline say August 20 if I am not a federal agency?: The August 20 date is CISA's binding remediation deadline for U.S. federal civilian agencies. It is not a legal deadline for anyone else, but it is a strong signal about severity: KEV listing means active exploitation, not theoretical risk.
Does it matter which browser I use?: The advisory names Firefox and Safari. Do not read that as an all-clear for anything else — read it as a reason to patch rather than to audit your browser choices.