Use case sources
Source reports and analysis supporting this case are listed below. AITBM interpretation and any indicative scoring are derived from this public evidence.
CVE-2025-62593 affects Ray before 2.52.0. A developer running the Ray Dashboard on its default port can be compromised after visiting a malicious page or advertisement in Firefox or Safari. Ray blocked POST and PUT only when the User-Agent header began with 'Mozilla'; both browsers allow JavaScript to set another value, so the request no longer looked like browser traffic to the middleware. DNS rebinding then repointed the attacker's origin at port 8265 on localhost or a private Ray host, and page JavaScript submitted an unauthenticated job containing attacker-selected commands, which Ray executed.
The advisory's proof of concept opens Calculator; broader payloads are possible but are not evidence of a specific observed campaign. CISA added the CVE to the Known Exploited Vulnerabilities catalog on 2026-08-17 without attributing the exploitation.
ASSESSED SYSTEM
A Ray installation before 2.52.0 running its Dashboard on the default port 8265 on a developer workstation or private host, in its pre-fix state: the Jobs API is unauthenticated, and the only barrier to browser-originated writes is middleware that blocks POST and PUT when the User-Agent header begins with 'Mozilla'. Representative configuration: any Ray deployment below 2.52.0 whose dashboard port is reachable from a browser process on the same host or private network.
OUT OF SCOPE
The attacker's page, advertisement, and DNS infrastructure are not the assessed system. Firefox and Safari are not assessed; the advisory states Chrome was not vulnerable through this header-setting path at disclosure time, and browser behaviour is context for reachability rather than a scored control. Ray 2.52.0 and later is out of scope. The KEV listing establishes exploitation without attribution or detail, so no victim, campaign, or payload outcome is scored.
Architecture: Traditional ML / Classifier (decision tree Q6) — The decision tree resolves at Q6 by elimination. Q1 = NO (no coordinating agents). Q2 = NO (the Jobs API executes submitted work; it holds no goal, plan, or task state of its own). Q3 = NO (no model invokes a function on this path; the dashboard middleware and job submission API are ordinary service endpoints). Q4 = NO (no retrieval layer). Q5 = NO (no generative interface participates in the disclosed path). What remains is distributed AI/ML compute infrastructure and its management API, which the classifier weight class represents. Tier 3: Tier 3 (Internal): the assessed surface is a development and internal-cluster management dashboard, and the advisory's own framing is a developer running the Ray Dashboard on its default port. Its remediation guidance — bind dashboards to a controlled interface, apply host firewall and network policy including on developer laptops and shared workstations — is internal-service guidance. The severity of arbitrary command execution is carried by Cascade Potential and the Containment scores, not by raising the tier.
Documented attack or failure path
- The victim loads content from the attacker's domain in Firefox or Safari.
- Subsequent DNS answers point that same origin at port 8265 on localhost or a private Ray host, so page JavaScript can address the dashboard from within the attacker's origin.
- Page JavaScript sets a non-Mozilla User-Agent value, defeating Ray's browser heuristic, so the middleware no longer treats the request as browser traffic and permits POST.
- The page submits an unauthenticated job to the Jobs API containing attacker-selected commands; Ray executes the supplied command on the host.
Observed controls and bounded outcomes
Positive credit is given only where the record directly demonstrates a control operating. Recommended or merely presumed controls receive no positive scoring credit.
- A write-blocking control existed on the dashboard middleware and did stop ordinary browser POST and PUT traffic: the advisory's chain required an explicit header-setting step to defeat it, and it holds against browsers that do not permit that step. The advisory verifies Firefox and Safari and states that Chrome was not vulnerable through this header-setting path at disclosure time.
- The advisory scopes the disclosed defect to the browser-origin heuristic and the unauthenticated Jobs API; the job execution engine itself is not characterised as defective.
Layer 1 — Intrinsic Vulnerability Profile
Each sub-metric is placed on its five-level rubric by the evidence quoted beside it. Missing applicable evidence remains unknown. The displayed midpoint and interval are scenario values, not inferred control performance.
| Sub-metric | Score | Rubric basis | Evidence |
|---|---|---|---|
| Robustness (Ro) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 3 MVT 0.40 indeterminate | |||
| Fairness (Fa) NOT APPLICABLE — axis-level applicability rule (Person-Outcome Surface test): The assessed system is a Ray compute cluster's Dashboard and Jobs API, whose outputs are submitted job executions on the host; it allocates, ranks, classifies or describes no natural person and no protected-class attribute or proxy in the job-submission inputs influences that outcome. Its tier weight is redistributed across the remaining axes and its MVT is not evaluated. | |||
| Transparency (Tr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 3 MVT 0.45 indeterminate | |||
| Privacy (Pr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 3 MVT 0.50 indeterminate | |||
| Containment (Cn) — scenario interval 0.00–0.48 (midpoint 0.24), Tier 3 MVT 0.50 confirmed breach | |||
| Cn-1Scope Enforcement | 0.00w 0.22 | 0.00 anchor: no effective scope boundary exists between an accepted job and the host's resources; the executed command is unconstrained. The 0.25 anchor requires a boundary that exists but is inconsistently enforced, and no execution-scope boundary is evidenced at all. | The submitted job contains attacker-selected commands and Ray executes them. Nothing constrains what an accepted job may do on the host, and the advisory's remediation asks defenders to restrict port 8265 and other Ray management endpoints with host firewall and network policy — a boundary placed outside the product because none exists inside it.source: brief |
| Cn-2Escalation Prevention | 0.00w 0.22 | 0.00 anchor: no escalation control is evidenced on the path from an untrusted browser origin to host command execution. The 0.25 anchor requires role checks that exist but can be defeated by role confusion; here no role boundary is applied to job submission at all. | An ordinary web page origin converted into command execution on the developer's host. No privilege reduction, execution principal, or step-up check separates a dashboard request from host command execution; the advisory's guidance is to hunt for jobs launched shortly after visits to unfamiliar domains, which presumes the escalation is not prevented.source: brief |
| Cn-5Agent Identity Integrity | 0.00w 0.08 | 0.00 anchor: no identity verification exists — the API accepts arbitrary callers and the header heuristic asserts nothing about who is calling. The 0.25 anchor requires at least basic API-key authentication, which the disclosed configuration does not have. | Ray's only caller check was whether the User-Agent header began with 'Mozilla' — a spoofable, self-asserted string, and the advisory states plainly that a browser-origin heuristic is not an identity control and must not authorize command submission. The Jobs API itself is unauthenticated. AID-H-004.002 is recommended to require authenticated, short-lived caller credentials on every Jobs and job-agent API request.source: brief |
Unknown, not N/A: 17 applicable sub-metrics lack admissible public evidence. The lower, midpoint, and upper scenarios evaluate each at 0.00, 0.50, and 1.00 respectively; no weight is redistributed merely because evidence is missing.
Architecture-based NOT APPLICABLE: NOT APPLICABLE by design for this architecture class: Cn-8, Cn-9; excluded with the Fairness axis.
Layer 2 — Operational Risk Posture
| Dimension | Score | Justification |
|---|---|---|
| AaAutonomy Amplification | 0.25w 0.20 | The Jobs API executes work that a caller submits; it plans nothing, holds no task goal, and makes no independent decision. Autonomy on this path belongs to the submitter, not to the assessed system. |
| AsAttack Surface Exposure | 0.85w 0.25 | Between the 0.75 and 1.00 anchors. Untrusted, attacker-controlled content reaches the assessed API and drives it end to end, which is severe exposure — but reachability is conditioned on a victim loading attacker content in one of two specific browsers, and the endpoint itself is bound to localhost or a private host rather than published to an open network. It is not the unconditional open-origin exposure the 1.00 anchor describes. elevated |
| CpCascade Potential | 1.00w 0.30 | No verified System Dependency Graph exists for the assessed configuration, so the specification's worst-case default applies. It is independently corroborated on its merits: the observed path is ungated end to end and terminates in arbitrary command execution on a developer or cluster host — an irreversible node whose reachable set includes every credential on that host, which is why the advisory directs defenders to rotate accessible credentials if unexplained jobs executed.GDCP: corroborated by the observed path elevated |
| RfRemediation Feasibility | 0.25w 0.25 | The 0.25 anchor fits: a released fixed artefact exists. Ray 2.52.0 closes the disclosed vulnerability, no retraining is involved, and the durable additions the advisory asks for — Jobs API authentication and network policy on port 8265 — are configuration and deployment changes. Remediation is bounded by rollout verification, and the advisory notes that verification must inspect the running dashboard process rather than lockfiles or build manifests. |
Nelevated = 2 (dimensions strictly above 0.75) → CRM = 1.15.
Compound Risk Alert. Two or more dimensions are simultaneously elevated (spec 3.2.2); architectural decomposition is recommended before deployment.
Layer 3 — Public-evidence confidence diagnostic
| Component | Score | Basis |
|---|---|---|
| Pc — Public provenance evidence | 0.25 | At the 0.25 anchor. The advisory identifies the product, the affected version range, the default port, the exact middleware heuristic, the API used, the browsers verified, and the fixed release. It identifies no deployment owner, host inventory, identity policy, or evaluation artefact for a specific installation, and no AIBOM or equivalent record exists for the assessed configuration. |
| Ec — Public evaluation coverage | 0.14 | coverage 0.15 (3 of 20 applicable sub-metrics) × independence 1.00 × fidelity 0.95. No Full, Standard, or Lite pathway is claimed for a retrospective article. |
| Tf — Public-evidence freshness | 0.29 | Evidence dated 2025-11-26; age 326 days on the workpaper reference date. Components: T_calendar 0.29 · C_monitor 0.65 · C_event 0.65 · C_evidence 0.85. Binding term: T_calendar. C_monitor 0.65 — no detection of the rebinding chain is evidenced, and the advisory has to ask defenders to start hunting for unexpected Jobs API submissions from browser-like sessions and unusual User-Agent values. C_event 0.65 — the moderate row applies: the KEV listing establishes exploitation of the CVE, but no critical-invariant violation is confirmed in any specific assessed deployment. C_evidence 0.85 — a fixed release exists, but the finding stays open until the deployed population is reconciled against the running dashboard process rather than a version label. BAW does not apply: the assessed component holds no mutable behavioural state or multi-session accumulation. |
Public-evidence ACI = (Pc × Ec × Tf)1/3 = 0.22 — diagnostic status: Invalid as assessment-of-record evidence. It describes the evidence available to this case study, not the assurance of the underlying system, and is not inserted into the normalized-assurance scenario ERS.
Indicative ERS — normalized-assurance scenario
Published CVSS beside indicative ERS
Each published CVSS record is shown exactly as its scorer published it, one per vulnerability record, with the version, metric group and vector when stated, plus its source and access date. Records are never combined or inferred from a CVE's existence.
INDICATIVE ERS · NORMALIZED-ASSURANCE SCENARIO
4.5 midpoint, interval 1.8–7.2; Low-Moderate scenario band; ACI fixed at 1.00. The published CVSS records do not enter this calculation.
PUBLISHED CVSS · 1 record
CVE-2025-62593 CVSS 4.0 Base 9.4 Critical
| Published score | 9.4 |
|---|---|
| CVSS version | 4.0 |
| Metric group | Base |
| Severity | Critical |
| Vector | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H |
| Scored by | GitHub_M |
| Source record | https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/62xxx/CVE-2025-62593.json (accessed 2026-10-18) |
| Affected component | ray |
| Scope note | CNA affected product and described vulnerability match the scored assessed_system and are not excluded by out_of_scope. |
| Record SHA-256 | 1b72411b76d20af504915b452284f2d3f02a2a01c51a889ad301877b09da4f53 |
CVSS describes an individual vulnerability as its scorer published it. Indicative ERS describes the assessed AI deployment under the normalized-assurance scenario, so the two values are not direct equivalents and neither replaces the other.
AIDEFEND defences → AITBM sub-metrics
Identifiers are quoted as they appear on the AIDEFEND in Action brief or in the AIDEFEND SecureFlow defense map (audited AIDEFEND dataVersion 2026.10.15); the sub-metric mapping is AITBM's own, from the specification's AIDEFEND tables reconciled at catalogue data version 2026.10.15. AIDEFEND renumbers identifiers between releases, so the data version travels with every mapping and neither side's IDs should be cited without one. A mapping identifies a possible evidence route; a recommendation does not prove that the control was implemented or effective and receives no scoring credit by itself.
| Technique | Defence | Priority | Evidences |
|---|---|---|---|
| AID-H-004.002 | Service & API AuthenticationAIDEFEND dataVersion 2026.10.15. Authenticated, short-lived caller credentials on every Ray Jobs and job-agent API request is the Cn-5 control whose absence sets that sub-metric to 0.00; the advisory states directly that a browser-origin heuristic is not an identity control. | Very High | Tr-3 Cn-5 |
| AID-H-003.010 | Deployed AI Software Vulnerability Remediation LifecycleAIDEFEND dataVersion 2026.10.15. Reconciling all Ray installations and redeploying 2.52.0 or later with verification of the running dashboard process is the Rf remediation route; it is not IVP evidence for this case. | Very High | Ro-4 Ro-5 Tr-4 |
| AID-I-002.001 | Internal AI Network SegmentationAIDEFEND dataVersion 2026.10.15. Binding development dashboards to an explicitly controlled interface and using host firewalls or microsegmentation so browser processes and untrusted network zones cannot reach Ray management APIs is the Cn-1 boundary the assessed configuration places outside the product because it has none inside it. | High | Cn-4 |
WHAT THIS CASE TEACHES
Three boundaries each failed independently — an origin heuristic mistaken for identity, network reachability from a browser process to a management port, and an unauthenticated execution API — and the case scores 0.00 on all three Containment sub-metrics because a spoofable self-asserted header is not a control at any anchor. Ray 2.52.0 closes the disclosed path, but Cn-5 stays at 0.00 for any deployment that still authorises job submission by inspecting what the caller claims to be.
Sources: AIDEFEND in Action — Ray DNS Rebinding: A Malicious Page Reaches the Local Jobs API · Primary source — Critical RCE against Ray developers via Safari and Firefox DNS rebinding (GHSA-q279-jhrf-cc6v), 2025-11-26 · AIDEFEND SecureFlow — Ray Browser DNS Rebinding to Unauthenticated Jobs API RCE
AIDEFEND SecureFlow attack-flow cross-reference
The same incident is modelled step by step, with ATLAS technique labels and AIDEFEND defense mappings, in AIDEFEND SecureFlow. The flow is listed for navigation only; this record's evidence and scores come from the sources cited above. Open SecureFlow.
- Ray Browser DNS Rebinding to Unauthenticated Jobs API RCE (same incident · AIDEFEND curated research flow)ATLAS techniques: AML.T0011.003, AML.T0107, AML.T0050