CVE-2025-62593: Ray Critical RCE Vulnerability via DNS Rebinding in Safari & Firefox
Summary
CVE-2025-62593: Ray is vulnerable to Critical RCE via Safari & Firefox Browsers through DNS Rebinding Attack. Affects ray versions < 2.52.0. Fixed in 2.52.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ray is an open-source framework designed for building and running distributed applications. It provides a simple interface for parallel and distributed computing, enabling developers to scale their applications effortlessly. However, Ray has been found to have a critical vulnerability that exposes developers to remote code execution (RCE) attacks when using Safari and Firefox browsers. This vulnerability arises from the lack of authentication on critical API endpoints, making it susceptible to exploitation through DNS rebinding attacks.
Vulnerability Detail
The vulnerability in Ray stems from its decision not to implement authentication on critical endpoints such as '/api/jobs' and '/api/job_agent/jobs/'. This oversight allows attackers to exploit the system via a DNS rebinding attack, particularly targeting developers who may inadvertently visit malicious websites or ads. The current defense mechanism relies on the 'User-Agent' header, which can be easily manipulated by modern browsers, rendering it ineffective. As a result, attackers can execute arbitrary code on the developer's machine, leading to severe security implications.
How To Fix
Latest published version: 2.59.0 as of 23 Oct 2026
pip install --upgrade "ray==2.59.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.52.0
This is the first release that contains the fix.
pip install --upgrade "ray==2.52.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no effective workarounds to mitigate this vulnerability without applying the patch. However, users should avoid accessing untrusted websites or clicking on suspicious advertisements while using Ray in a development environment.
Conclusion
The CVE-2025-62593 vulnerability in Ray poses a significant risk to developers using Safari and Firefox due to its susceptibility to DNS rebinding attacks. It is essential to update to version 2.52.0 or higher to mitigate this risk and enhance security through the newly introduced authentication feature. Vigilance against phishing and malicious ads is also recommended until the update is applied.
See every vulnerability recorded for ray →
FAQ
The vulnerability allows for remote code execution (RCE) through DNS rebinding attacks, primarily affecting developers using Safari and Firefox.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors open-source vulnerabilities in real-time.
While there are no effective workarounds, it is crucial to avoid accessing untrusted websites and ads until you can apply the update.
If exploited, attackers can execute arbitrary code on the developer's machine, leading to data breaches, unauthorized access, and potential system compromise.
In addition to updating Ray, consider implementing network security measures and using firewalls to restrict access to your development environment.
References
Related vulnerabilities
Recent vulnerabilities recorded for ray.
