Ray is vulnerable to Critical RCE via Safari & Firefox Browsers through DNS Rebinding Attack

# Summary Developers working with Ray as a development tool can be exploited via a critical RCE vulnerability exploitable via Firefox and Safari. Due to the longstanding [decision](https://docs.ray.io/en/releases-2.51.1/ray-security/index.html) by the Ray Development team to not implement any sort of authentication on critical endpoints, like the `/api/jobs` & `/api/job_agent/jobs/` has once again led to a severe vulnerability that allows attackers to execute arbitrary code against Ray. This time in a development context via the browsers Firefox and Safari. This vulnerability is due to an insufficient guard against browser-based attacks, as the current defense uses the `User-Agent` header starting with the string "Mozilla" as a defense mechanism. This defense is insufficient as the fetch specification allows the `User-Agent` header to be modified. Combined with a DNS rebinding attack against the browser, and this vulnerability is exploitable against a developer running Ray who inadvertently visits a malicious website, or is served a malicious advertisement ([malvertising](https://en.wikipedia.org/wiki/Malvertising)). # Details The mitigations implemented to protect against browser based attacks against local Ray nodes are insufficient. ## Current Mitigation Strategies ```python def is_browser_request(req: Request) -> bool: """Checks if a request is made by a browser like user agent. This heuristic is very weak, but hard for a browser to bypass- eg, fetch/xhr and friends cannot alter the user-agent, but requests made with an http library can stumble into this if they choose to user a browser like user agent. """ return req.headers["User-Agent"].startswith("Mozilla") def deny_browser_requests() -> Callable: """Reject any requests that appear to be made by a browser""" def decorator_factory(f: Callable) -> Callable: @functools.wraps(f) async def decorator(self, req: Request): if is_browser_request(req): return Response( text="Browser requests not allowed", status=aiohttp.web.HTTPMethodNotAllowed.status_code, ) return await f(self, req) return decorator return decorator_factory ``` https://github.com/ray-project/ray/blob/f39a860436dca3ed5b9dfae84bd867ac10c84dc6/python/ray/dashboard/optional_utils.py#L129-L155 ```python @aiohttp.web.middleware async def browsers_no_post_put_middleware(self, request, handler): if ( # A best effort test for browser traffic. All common browsers # start with Mozilla at the time of writing. dashboard_optional_utils.is_browser_request(request) and request.method in [hdrs.METH_POST, hdrs.METH_PUT] ): return aiohttp.web.Response( status=405, text="Method Not Allowed for browser traffic." ) return await handler(request) ``` https://github.com/ray-project/ray/blob/e7889ae542bf0188610bc8b06d274cbf53790cbd/python/ray/dashboard/http_server_head.py#L184-L196 This is because the fundamental assumption that the `User-Agent` header can't be manipulated is incorrect. In Firefox and in Safari, the `fetch` API allows the `User-Agent` header to be set to a different value. Chrome is not vulnerable, ironically, because of a [bug](https://issues.chromium.org/issues/40450316), bringing it out of spec with the `fetch` specification. Exploiting this vulnerability requires a DNS rebinding attack against the browser. Something trivially done by modern tooling like [nccgroup/singularity](https://github.com/nccgroup/singularity). # PoC Please note, this full PoC will be going live at time of disclosure. 1. Launch Ray `ray start --head --port=6379` 2. Ensure that the ray dashboard/service is running on port `8265` 3. Launch an internet facing version of NCCGroup/Singularity following the [setup guide here](https://github.com/ncc

CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Severity from

GitHub (reviewed advisory)

Weakness

CWE-352, CWE-94

Also known as

CVE-2025-62593, PYSEC-2026-520

• github.com/ray-project/ray/security/advisories/GHSA-q279-jhrf-cc6v
• nvd.nist.gov/vuln/detail/CVE-2025-62593
• github.com/nccgroup/singularity/pull/68
• github.com/ray-project/ray/commit/70e7c72780bdec075dba6cad1afe0832772bfe09
• docs.ray.io/en/releases-2.51.1/ray-security/index.html
• en.wikipedia.org/wiki/Malvertising
• github.com/ray-project/ray
• github.com/ray-project/ray/blob/e7889ae542bf0188610bc8b06d274cbf53790cbd/python/ray/dashboard/http_server_head.py#L184-L196
• github.com/ray-project/ray/blob/f39a860436dca3ed5b9dfae84bd867ac10c84dc6/python/ray/dashboard/optional_utils.py#L129-L155