Opening One Web Page Runs Code on Your Laptop, and Ray Got Three Days

The US Cybersecurity and Infrastructure Security Agency (CISA) added Ray's remote code execution flaw CVE-2025-62593 (CVSS 9.4) to its Known Exploited Vulnerabilities (KEV) catalog on August 17, 2026. The remediation deadline is August 20, 2026, three days later. Under the old rules this slot would have been two to three weeks.

Ray is a Python framework that spreads work across many machines. It is used for LLM training, model serving, and large-scale data processing, and a single ray.init() call starts it on a laptop too. That laptop is exactly what this vulnerability goes after.

The target is a developer machine, not a server

What normally lands on the KEV catalog sits on the internet edge: VPN gateways, firewalls, web servers. CVE-2025-62593 does not. The CISA entry itself says "developers using Ray as a development tool could be exposed" and then adds that it is "exploitable via Firefox and Safari."

The attack path runs like this. A developer leaves Ray running on a laptop. The dashboard is bound to localhost only and never crosses the firewall. In that state the developer opens a malicious web page in Firefox or Safari, or picks up a malicious script served through an ad slot. Arbitrary shell commands then execute on that developer's machine. No click required.

The firewall does not help, because the request comes from the developer's own browser rather than from the attacker. Every previous Ray security incident was about clusters left exposed on the open internet. This one targets isolated development environments.

Two bypasses stacked together

The attack has two stages. Each is an old technique on its own, and they only become dangerous when combined.

Stage one. To block requests coming from browsers, vulnerable Ray versions checked only whether the User-Agent header started with Mozilla. Per the fetch specification, Firefox and Safari let scripts change that header. Set it to any other string and the check passes. Chrome does not allow the change, an implementation difference, so it is unaffected.

Stage two. DNS rebinding means the attacker's domain first resolves to the attacker's server and, moments later, to 127.0.0.1. To the browser it is still the same domain, so same-origin policy does not fire, while the request actually lands on the local Ray instance.

Stack the two and you can submit jobs to /api/jobs and /api/job_agent/jobs/ without any authentication. In Ray, submitting a job is arbitrary code execution. Leaving those two endpoints unauthenticated is a long-standing Ray design decision.

The finders are Jonathan Leitschuh of Socket (the DNS rebinding technique and proof-of-concept code) and Avi Lumelsky of Oligo (the fetch bypass). The official advisory names the root cause directly: "The Ray development team's long-standing decision not to include any form of authentication on core endpoints has once again led to a serious vulnerability, this time reachable through the browser in development environments."

The patch did not hold on the first try

The 2.52.0 fix was a denylist: block POST and PUT requests originating from browsers. DELETE was not on the list.

That produced CVE-2026-27482. On 2.53.0 and below, browser-origin DELETE requests pass straight through, and the main DELETE endpoints have no authentication by default. The same DNS rebinding lets an attacker shut down Serve deployments or delete running jobs. The CVSS score is a low 3.1, but it shows that the first patch blocked three known HTTP methods rather than the attack technique.

Version 2.54.0 (February 18, 2026) switched to an allowlist. Instead of enumerating what to block, it blocks every browser-origin state-changing request to the agent HTTP server and then names the specific exceptions that may pass.

Where the three days came from

The rule that computes the deadline changed two months ago. On June 10, 2026, CISA put Binding Operational Directive 26-04, "Prioritizing Security Updates Based on Risk," into effect and rescinded BOD 22-01, which had been in force since November 2021.

What changed is how the deadline is calculated.

The required-action text on the KEV entry points directly at BOD 26-04 and its "forensic triage requirements." So these three days are not an exceptional emergency measure; they are the top tier of the new rating table being applied. Agencies have until December 7, 2026 to implement the directive, and it binds only US federal civilian agencies.

CISA's basis for rating this combination at the top comes from exploitation history. BitSight reported in March 2026 that operators of the RondoDox DDoS botnet weaponized the flaw starting two days before proof-of-concept code was public. The ShadowRay 2.0 campaign that Oligo disclosed in November 2025 converted unpatched Ray instances with NVIDIA GPUs into cryptocurrency mining botnets, and reported more than 200,000 Ray servers exposed on the internet, roughly ten times the few thousand found in the original 2024 investigation.

What to check now

Ray is an Apache 2.0 open-source pip package, so there is no pricing tier and no regional restriction. Anyone can install it and anyone can remediate it. What you need is a version check and one setting.

Check the version like this:

pip show ray | grep -i version
ray --version

Token authentication landed in 2.52.0, but it is off by default. The release notes say so explicitly, and Ray's own security documentation pins it down further: token authentication is "a defense-in-depth measure on top of network-level security, not a substitute for deploying Ray on an isolated network." Turning it on is a manual step.

export RAY_AUTH_MODE=token
ray get-auth-token --generate

Ray looks for the token in this order: the RAY_AUTH_TOKEN environment variable, the RAY_AUTH_TOKEN_PATH environment variable, then the default path ~/.ray/auth_token. ray.init() generates a token automatically when none exists, but ray start --head requires you to create one first. Tokens do not expire, so they stay valid until you delete and regenerate them.

If Ray is installed on your laptop or a development box, run pip show ray today and upgrade anything below 2.54.0. That is the whole job. The same assumption we ran into when covering the approval miss rate on commands coding agents execute shows up here: development machines get treated as safe because they are not exposed to the internet, and this flaw routes around that by using the browser. Sweeping the pinned Ray versions in container images and CI runners is what actually finishes the work.