Listen to this Post
Ray is an AI compute engine widely used for distributed machine learning and scaling Python workloads. Prior to version 2.52.0, this engine contains a critical remote code execution vulnerability that specifically targets developers who interact with Ray through a web browser. The attack surface is primarily accessible via Firefox and Safari, though other browsers may also be affected under certain conditions. The vulnerability stems from an inadequate security guard that inspects incoming HTTP requests. The current defense logic checks the User-Agent header for the prefix string “Mozilla” to distinguish legitimate browser traffic from potential automated attacks. This design is fundamentally flawed because the fetch API specification, which governs modern web requests, explicitly allows client-side JavaScript to override and modify the User-Agent header arbitrarily. An attacker can therefore craft a malicious webpage that, when loaded by a developer, sends a carefully constructed request to the Ray dashboard or API endpoint with a forged “Mozilla” User-Agent. This bypasses the superficial check without any technical difficulty. To escalate this into a full exploit, the attacker combines this spoofing technique with a DNS rebinding attack. In a DNS rebinding attack, the attacker controls a domain that initially resolves to a benign IP address to pass browser security policies, but then switches to resolve to the internal IP address of the Ray instance after the page has loaded. This effectively tricks the same-origin policy and allows the malicious website to make cross-origin requests directly to the vulnerable Ray service running on localhost or an internal network. Once the request reaches the Ray dashboard, the lack of proper CSRF tokens and the reliance on the weak User-Agent check allow the attacker to inject arbitrary operating system commands or Python code through the Ray job submission or runtime environment APIs. This leads to immediate code execution on the Ray head node with the privileges of the running process. The vulnerability is classified under CWE-352 (Cross-Site Request Forgery) for the initial bypass and CWE-94 (Improper Control of Generation of Code) for the eventual injection. The attack is passive in nature, requiring only that a developer visits an attacker-controlled website or clicks a malicious advertisement (malvertising). No user interaction beyond that visit is required. The issue was responsibly disclosed to the vendor, and a fixed version, 2.52.0, has been released. CISA has added this CVE to its Known Exploited Vulnerabilities catalog with a specific remediation deadline. Organizations are urged to treat this with the highest priority due to the trivial exploitation chain and the widespread deployment of Ray in AI development environments. The patch replaces the header check with a robust origin validation mechanism.
DailyCVE Form:
Platform: Anyscale Ray
Version: Under 2.52.0
Vulnerability: RCE Injection
Severity: Critical
date: Nov 26 2025
Prediction: Aug 20 2026
What Undercode Say:
Check installed Ray version:
pip show ray | grep Version
Verify vulnerable range (below 2.52.0):
ray –version
Test User-Agent spoofing against dashboard:
curl -H “User-Agent: Mozilla/5.0” http://localhost:8265/api/version
Simulate malicious fetch request (conceptual):
fetch(‘http://ray-head:8265/api/jobs’, { headers: { ‘User-Agent’: ‘Mozilla/5.0’ } })
Detect DNS rebind potential using dig:
dig +short malicious.attacker.com
Monitor Ray logs for unauthorized job submissions:
tail -f /tmp/ray/session_/logs/dashboard.log
Exploit: (Educational Purposes!)
- Register a domain and configure a DNS server with a very low TTL.
- Initially resolve the domain to a public IP (e.g., 1.2.3.4) to pass browser SOP.
- When the developer visits the malicious page, the page loads scripts that send requests to the domain.
- After the page loads, change the DNS resolution to the internal IP of the Ray dashboard (e.g., 127.0.0.1 or 192.168.1.x).
- Use the fetch API to POST a job submission payload to /api/jobs with the User-Agent set to “Mozilla/5.0”.
- The Ray dashboard accepts the request due to the weak guard.
- Inject a Python command (e.g., import(‘os’).system(‘id’)) within the runtime environment field.
- The command executes on the Ray head node, granting the attacker a reverse shell or system access.
Protection:
Immediately upgrade Ray to version 2.52.0 or any later release. If immediate patching is not possible, disable the Ray dashboard entirely by setting the environment variable RAY_DASHBOARD=0 or using the –dashboard-host 127.0.0.1 flag to restrict access to localhost only. Deploy network-layer firewalls to block external access to the Ray dashboard ports (default 8265) from untrusted networks. Apply CISA’s required action by following BOD 26-04 guidance, including evaluating internet exposure and implementing vendor-supplied mitigations. Consider using a reverse proxy with strict origin header validation as an additional control layer.
Impact:
Successful exploitation results in complete remote code execution on the Ray cluster’s head node. This allows the attacker to read, modify, or delete any data accessible to the Ray process, install backdoors, pivot to internal systems, steal sensitive AI models and training datasets, and deploy cryptocurrency miners or ransomware. The integrity and availability of the entire distributed computing environment are compromised, leading to potential supply chain attacks if the compromised environment is used for CI/CD or model deployment pipelines.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
