A malicious website could reach an unpatched Ray developer environment

Ray is widely used to distribute AI and machine-learning workloads, often inside development networks that teams assume are difficult to reach from the internet. CVE-2025-62593 challenges that assumption. Through DNS rebinding, a malicious website or advertisement can use a developer’s browser as a bridge to an unpatched Ray service and execute commands. The browser is not infected in the traditional sense; it becomes the trusted messenger between an external attacker and an internal endpoint. CISA has added the flaw to its exploited-vulnerability catalog, which means this is no longer a theoretical laboratory scenario. Ray 2.52.0 fixes the issue. Teams should upgrade, restrict administrative endpoints, review where Ray services are reachable from employee devices and examine unusual job or command activity. The broader warning is important for AI environments: private addressing alone is not a security boundary when browsers, extensions and web content can interact with internal services.