Ray (versions below 2.52.0)
Ray is an open-source Python framework used by developers and data scientists to run large AI and machine learning workloads across many computers at once.
Root Cause
Ray's development team has not implemented authentication on critical internal endpoints, including /api/jobs. Because these endpoints accept requests from browsers without verifying who is asking, and because the User-Agent header can be freely modified by a webpage, an attacker-controlled site can manipulate a browser into sending commands directly to Ray as if it were the legitimate user.
Attack Vector
A developer visits a malicious website or is served a malicious ad while Ray is running locally. The page performs a DNS rebinding attack, redirecting the browser to Ray's unauthenticated API. The attacker submits a crafted job request, and Ray executes it with the developer's own system privileges. The attack can also reach Ray instances running inside a private corporate network by using the victim's browser as an unwitting intermediary. The RondoDox DDoS botnet incorporated this vulnerability two days before public disclosure in November 2025, and a separate campaign (ShadowRay 2.0) has used unpatched Ray instances to build a cryptocurrency mining botnet.
Detection Notes
Check Ray job logs for unexpected job submissions, particularly shell commands or curl-based install scripts. Look for outbound network requests from Ray processes to unfamiliar external addresses. Monitor for new or modified files in home directories on machines where Ray is running.
Recommended Actions
- Upgrade Ray to version 2.52.0 immediately — FCEB agencies must patch by 20 August 2026.
- Restrict Ray dashboard and API ports to localhost only; do not expose them on a network interface.
- Avoid browsing untrusted websites while Ray is running locally.