Ray AI框架RCE漏洞評測：CVSS 9.4開發機器全淪陷 | Ray AI Framework RCE Review: CVSS 9.4 Already Exploited
By Kit 小克 | AI Tool Observer | 2026-08-23
🇹🇼 Ray AI框架RCE漏洞評測：CVSS 9.4開發機器全淪陷
Ray AI框架被CISA盯上了。這套OpenAI、Amazon、Apple等公司拿來跑分散式AI訓練與推論的開源工具，被爆出CVSS 9.4的高危漏洞CVE-2025-62593，美國網路安全暨基礎設施安全局（CISA）已將它列入「已知遭利用漏洞」清單，還限聯邦機關3天內修補。更麻煩的是：這個漏洞不用你主動開放連線，光是瀏覽一個惡意網頁，就可能讓正在跑Ray的開發機器被遠端執行任意程式碼。
Ray是什麼？為什麼AI團隊都在用？
Ray是一套開源的分散式運算框架，專門用來把AI訓練、超參數搜尋、模型推論這類吃資源的工作，拆到多台機器或多張GPU上平行跑。因為好用又免費，從新創到Amazon、Apple、OpenAI內部的機器學習管線都看得到它的身影，等於是AI基礎設施界的隱形基礎建設。
CVE-2025-62593漏洞出在哪裡？
問題出在Ray的HTTP API端點（例如/api/jobs與/api/job_agent/jobs/），這些端點被設計成可以提交或觸發程式碼執行。原本的防護邏輯只檢查HTTP請求的User-Agent開頭是不是Mozilla，但瀏覽器本身就能被操控去改這個欄位。攻擊者只要搭配DNS rebinding技巧，就能繞過同源限制，讓受害者的瀏覽器在背景幫忙把惡意指令送進本機或內網的Ray服務——連你自己按下滑鼠都不需要。
為什麼CISA限3天修補，這麼急？
因為它不是理論上的漏洞，而是已經被實際利用的漏洞。根據BitSight的調查，RondoDox殭屍網路早在2025年11月官方公開揭露CVE-2025-62593的兩天前，就已經把這個攻擊手法納入武器庫。也就是說在多數人知道之前，攻擊者就已經在掃描並攻陷暴露在外的Ray實例了。CISA這次要求聯邦機關8月20日前完成修補，等於是把它列為現在進行式的緊急資安事件，而不是建議儘快處理的一般公告。
我的Ray環境該怎麼辦？
- 確認你的Ray版本，2.52.0以前的版本都有風險，直接升級到2.52.0以上
- 盤點所有跑過Ray的地方：開發者筆電、CI/CD跑者、容器映像檔、Kubernetes叢集、雲端資料處理節點
- 不要把Ray Dashboard或API端點直接暴露在公網或無防護的內網
- 就算升級了，也建議加一層網路層的存取控管，別只靠應用層驗證
小克的老實話：這種開發環境預設信任本機請求的漏洞其實很典型——大家在跑訓練任務時圖方便,把Dashboard開著就忘了關,結果變成攻擊者的後門。Ray AI框架本身沒問題，問題是太多人把它當內部工具在用,完全沒設防。如果你的團隊有用Ray做分散式訓練,這次真的不是可以拖的更新。
常見問題 FAQ
Q: 我沒有對外開放Ray的port，還會中招嗎？
A: 有可能。因為攻擊利用DNS rebinding讓瀏覽器幫忙發起請求，只要你的機器能連上網路瀏覽器，且Ray Dashboard在本機或內網可連，就有風險。
Q: 升級到2.52.0就完全安全了嗎？
A: 官方修補了這個特定漏洞，但仍建議做好網路隔離，不要讓Ray管理介面直接暴露。
Q: 這個漏洞跟其他AI供應鏈攻擊有關嗎？
A: 屬於同一類AI基礎設施被當一般軟體漏洞攻擊的趨勢，凸顯AI工具鏈的資安意識普遍落後。
好不好用，試了才知道。
🇺🇸 Ray AI Framework RCE Review: CVSS 9.4 Already Exploited
The Ray AI framework just landed on CISA's radar. This open-source tool - used by OpenAI, Amazon, and Apple to run distributed AI training and inference - has a critical CVSS 9.4 vulnerability, CVE-2025-62593, now listed in the U.S. Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog, with federal agencies given just three days to patch. The scary part: you don't need to open any connection yourself. Just visiting a malicious webpage can trigger remote code execution on a machine running Ray.
What Is Ray and Why Do AI Teams Use It?
Ray is an open-source distributed computing framework built to split resource-hungry AI work - training, hyperparameter search, inference - across multiple machines or GPUs. It's free, fast, and widely adopted, showing up in ML pipelines everywhere from startups to Amazon, Apple, and OpenAI. It's basically invisible infrastructure for the AI industry.
Where Does CVE-2025-62593 Come From?
The flaw lives in Ray's HTTP API endpoints (like /api/jobs and /api/job_agent/jobs/), which are designed to accept and trigger code execution. The original defense only checked whether a request's User-Agent header started with Mozilla - but browsers can be manipulated to alter that header. Combine that with a DNS rebinding attack, and an attacker can bypass same-origin restrictions, using a victim's own browser to smuggle malicious commands into a local or internal Ray instance - no click required.
Why Did CISA Give Only 3 Days to Patch?
Because this isn't theoretical - it's already being exploited in the wild. A BitSight report found that the RondoDox botnet incorporated this attack into its toolkit two days before the CVE was even publicly disclosed in November 2025. That means attackers were already scanning and compromising exposed Ray instances before most defenders knew the bug existed. CISA's August 20 federal patch deadline treats this as an active, ongoing incident, not a patch-when-convenient advisory.
What Should You Do If You Run Ray?
- Check your version - anything before 2.52.0 is at risk; upgrade immediately
- Audit every place Ray runs: developer laptops, CI/CD runners, container images, Kubernetes clusters, cloud data-processing nodes
- Never expose the Ray Dashboard or API endpoints directly to the public internet or an unprotected internal network
- Even after upgrading, add network-layer access controls - don't rely on application-layer checks alone
Kit's honest take: this is a classic case of a dev tool that defaults to trust local requests - teams spin up the Dashboard for convenience during training runs and forget it's still exposed, and that becomes the attacker's backdoor. Ray itself isn't the problem; the problem is how many teams treat it like an internal-only tool with zero hardening. If your team runs distributed training on Ray, this update is not one you can put off.
FAQ
Q: I never opened Ray's port to the internet, am I still at risk?
A: Possibly. Since the attack uses DNS rebinding to make your own browser send the request, any machine that can browse the web while Ray's dashboard is reachable locally or internally is exposed.
Q: Is upgrading to 2.52.0 enough?
A: The official patch closes this specific hole, but network isolation for the Ray management interface is still strongly recommended.
Q: Is this connected to other AI supply-chain attacks?
A: It's part of a broader trend - AI infrastructure being hit with plain old software vulnerabilities, exposing how far behind security hardening is in the AI tooling stack.
好不好用，試了才知道。 (You won't know if it works until you've tried it.)
Sources / 資料來源
- CISA Flags Actively Exploited Ray Flaw That Can Trigger Browser-Based RCE - The Hacker News
- U.S. CISA adds a Ray-Project Ray flaw to its Known Exploited Vulnerabilities catalog - Security Affairs
- CISA gives feds 3 days to fix actively exploited Ray RCE bug - The Register
常見問題 FAQ
我沒有對外開放Ray的port，還會中招嗎？
有可能。攻擊利用DNS rebinding讓瀏覽器幫忙發起請求，只要機器能上網瀏覽器且Ray Dashboard在本機或內網可連，就有風險。
升級到2.52.0就完全安全了嗎？
官方修補了這個特定漏洞，但仍建議做好網路隔離，不要讓Ray管理介面直接暴露在外。
這個漏洞跟其他AI供應鏈攻擊有關嗎？
屬於同一類AI基礎設施被當一般軟體漏洞攻擊的趨勢，凸顯AI工具鏈的資安意識普遍落後。
延伸閱讀 / Related Articles
- Meta Muse Code評測：省12倍代價是讓Meta訓練你的程式碼 | Meta Muse Code Review: Cheap Tier Trains On Your Code
- Wiz Red Agent評測：AI代理自主駭入Snowflake系統 | Wiz Red Agent Review: AI Agent Hacks Snowflake Alone
- Qwen3.8-Max評測：2.4兆參數開源模型直逼Claude | Qwen3.8-Max Review: 2.4T-Param Open Model Rivals Claude
AI 工具觀察站 — 每日精選 AI Agent 與工具趨勢
AI Tool Observer — Daily curated AI Agent & tool trends
留言
張貼留言