Ray (dashboard job submission API, browser-origin guard): Ray's only defense against browser-driven job submission was

Impact

Ray's only defense against browser-driven job submission was a User-Agent check, which Firefox and Safari let an attacker route around via DNS rebinding. A developer merely visiting a malicious web page hands the attacker remote code execution on their Ray cluster - including laptop-local dev clusters that were never meant to be reachable. CISA added this to the KEV catalog on 2026-08-17, so treat it as actively exploited.

Who can reach it

A remote web page loaded in the victim's Firefox or Safari, which then rebinds DNS to reach a Ray dashboard on localhost or on any network the victim's browser can route to. No credentials on the Ray side.

What to do

Upgrade Ray to 2.52.0 or later, then enable token authentication (RAY_AUTH_MODE=token) since the 2.52.0 fix alone does not authenticate the endpoints. Restart head and workers. Given the KEV listing, also audit job history and node processes on any cluster that was reachable from a developer workstation.

References