The Cybersecurity and Infrastructure Security Agency (CISA) has issued a high-priority advisory adding CVE-2025-62593 to its Known Exploited Vulnerabilities catalog. The flaw targets Ray, the popular open-source unified compute framework maintained by Anyscale and deployed across hundreds of global AI enterprises to scale large language model (LLM) training runs, reinforcement learning workloads, and distributed Python workflows.

Holding a critical CVSS v3.1 base score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the vulnerability permits unauthenticated remote threat actors with access to the Ray dashboard or Ray Jobs API listener (default TCP port 8265) to inject and execute arbitrary Python code directly across all worker and head nodes within the cluster.

Attack Mechanics: Unauthenticated Jobs REST API & Node Execution

The vulnerability stems from the historical design of the Ray framework, which operates without built-in authentication layers under the assumption that clusters run exclusively inside isolated private networks:

  • Public API Exposure: Ray clusters deployed across cloud container platforms (such as Kubernetes via KubeRay) frequently expose the Ray Dashboard and Jobs REST API (port 8265) to external networks or unsegmented VPCs.
  • Arbitrary Job Submission: The Jobs API endpoint (/api/jobs/) accepts unauthenticated HTTP POST requests containing serialized job configurations, Python command parameters, and shell execution commands.
  • Cluster-Wide Privilege Seizure: The Ray head node receives the job submission and distributes the execution tasks across worker nodes. Threat actors execute arbitrary shellcode, install persistent backdoors, dump sensitive training data, and hijack clusters of enterprise GPUs (Nvidia H100/A100) for crypto-mining and botnet operations.

AI compute clusters represent tens of millions of dollars in specialized GPU silicon and house proprietary model weights. An unauthenticated code injection flaw across distributed AI nodes gives adversaries access to the core intellectual property of generative AI companies.

Affected Software Deployments & Status

Ray Deployment Architecture Vulnerable Releases Remediated Configuration Remediation Mandate
Ray Open Source (Head & Worker Nodes) All versions prior to 2.38.0 Ray 2.38.0 or Auth Proxy Emergency Directive Action Required
KubeRay Operator (Kubernetes) Unauthenticated Ingress configurations Enforce mTLS / Ingress Auth Emergency Directive Action Required
Anyscale Managed Cloud Platform SaaS Managed Workspaces Auto-Remediated Vendor Defense Applied

Detection, Audit & Defensive Playbook

MLOps platform teams and security operations engineers must audit their AI compute clusters immediately using the following CLI procedures:

# Audit active listening ports on Ray head nodes
netstat -tulpn | grep -E "8265|10001|6379"

# Inspect Ray job submission logs for unauthorized external requests
grep -iE "job_id|submission" /tmp/ray/session_latest/logs/dashboard.log

# Verify that port 8265 is blocked from public internet routing
curl -I -m 5 http://[EXTERNAL_IP]:8265/api/version

Recommended Enterprise Safeguards

  • Enforce Reverse Proxy Authentication: Place all Ray Dashboards and Jobs APIs behind authenticated reverse proxies (such as Nginx, OAuth2-Proxy, or Cloudflare Access) requiring multi-factor authentication (MFA).
  • Deploy Strict Kubernetes Network Policies: In Kubernetes clusters running KubeRay, enforce NetworkPolicies that prevent external ingress traffic from reaching Ray head and worker pods on ports 8265, 10001, and 6379.
  • Update to Ray 2.38.0+: Upgrade to the latest Ray releases which provide built-in token authentication flags (--dashboard-auth-token) to restrict API access.