Incident Published: Aug 24, 2026

Ray DNS Rebinding: A Malicious Page Reaches the Local Jobs API

CVE-2025-62593 affects Ray before 2.52.0. A developer running the Ray Dashboard on its default port can be compromised after visiting a malicious page or advertisement in Firefox or Safari. DNS rebinding changes the attacker's origin to the local or private Ray endpoint; browser JavaScript sets a non-Mozilla User-Agent to bypass Ray's weak browser heuristic, then submits a job to the unauthenticated Jobs API. Ray executes the supplied command. CISA added the CVE to KEV on August 17, 2026, but has not attributed the exploitation.

Remote Code ExecutionIdentity & AccessSystem-Level DefenseAI InfrastructureWeb Security
3 applicable AIDEFEND defenses
Source: Critical RCE against Ray developers via Safari and Firefox DNS rebinding (GHSA-q279-jhrf-cc6v) 
Authors: avilum (fetch-bypass concept, Oligo); Jonathan Leitschuh / JLLeitschuh (DNS-rebinding chain, full PoC, and disclosure; then at Socket)
Original article: Nov 26, 2025

Threat Analysis

  • The browser check trusted a spoofable header. Ray blocked POST and PUT only when User-Agent began with Mozilla. Firefox and Safari allow JavaScript to set another value, so the request no longer looks like browser traffic to the middleware.
  • DNS rebinding crosses the origin-to-network boundary. The victim first loads content from the attacker's domain; subsequent DNS answers point that same origin at port 8265 on localhost or a private Ray host.
  • The Jobs API supplies the execution sink. After the header bypass, the page submits an unauthenticated job containing attacker-selected commands. The advisory proof of concept opens Calculator; broader payloads are possible but are not evidence of a specific observed campaign.
  • Browser scope matters. The advisory verifies Firefox and Safari and explicitly states that Chrome was not vulnerable through this header-setting path at disclosure time.

Applicable AIDEFEND Defenses (3)

AID-H-004.002
Service & API Authentication
Very High
Require authenticated, short-lived caller credentials on every Ray Jobs and job-agent API request. A browser-origin heuristic is not an identity control and must not authorize command submission.
AID-H-003.010
Deployed AI Software Vulnerability Remediation Lifecycle
Very High
Reconcile all Ray installations and redeploy 2.52.0 or later through a staged rollout, verifying that every running dashboard uses the remediated artifact.
AID-I-002.001
Internal AI Network Segmentation
High
Bind development dashboards to an explicitly controlled interface and use host firewalls or microsegmentation so browser processes and untrusted network zones cannot reach Ray management APIs by default.

What Defenders Should Do Now

  • Upgrade every Ray deployment below 2.52.0 and verify the running dashboard process, not only lockfiles or build manifests.
  • Require authentication and authorization for Jobs API operations; do not rely on User-Agent, Origin alone, or assumptions about browser-forbidden headers.
  • Restrict port 8265 and other Ray management endpoints with host firewall and network policy, including on developer laptops and shared workstations.
  • Hunt for unexpected Jobs API submissions from browser-like sessions, unusual User-Agent values, and jobs launched shortly after visits to unfamiliar domains.
  • If unexplained jobs executed, investigate the host and rotate accessible credentials; do not attach the case to a named botnet or payload without separate evidence.

Conclusion

This chain combines three boundaries that each failed: browser-origin assumptions, network reachability to a local management service, and an unauthenticated code-execution API. Ray 2.52.0 fixes the disclosed vulnerability. Authentication and network isolation remain necessary because header heuristics cannot establish who is allowed to submit work.