CVE-2025-62593 is a DNS rebinding vulnerability in Anyscale's Ray platform that allows attackers to achieve remote code execution on developer workstations running local Ray instances. The root cause is straightforward: Ray's development server attempted to block browser-originated requests by checking the User-Agent header, a security control that was already obsolete when abandoned by the web security community over two decades ago. The fetch specification has always permitted User-Agent manipulation—this is a feature of the browser platform, not a flaw. Attackers exploit this by registering a domain they control, having the victim's browser resolve it initially (passing the User-Agent check), then rapidly flipping the DNS resolution to point to localhost where the Ray service is running. The browser's same-origin policy permits the request because it believes it's still communicating with the attacker's domain, while the request actually reaches the local Ray instance with full privileges.
If you're running Ray, the immediate action is upgrade to 2.52.0 or later. However, verify what that patch actually changed: if Anyscale simply removed the User-Agent check without implementing token-based or cryptographic authentication at the local interface level, this vulnerability class remains exploitable through future bypass vectors. The safer mitigation is binding Ray exclusively to loopback (127.0.0.1) or requiring authenticated connections even for local access.
The deeper pattern here matters more than this specific CVE. This is the nth iteration of development tools trusting browser requests as somehow more legitimate than other network traffic—Redis, MongoDB, Jupyter, and countless local dev servers have all suffered similar bypasses. The convenience default of network-listening, combined with heuristic "security" that relies on client-supplied values, creates the precondition for these vulnerabilities. As AI/ML infrastructure becomes more prevalent on developer machines, the blast radius of compromise expands beyond traditional dev environments: a compromised Ray instance can access training data, model weights, and whatever proprietary information that compute job was processing. Standard CVSS scoring doesn't capture this asymmetric risk. Assume any network-listening development tool can be reached by attacker-controlled domains via DNS rebinding, and architect accordingly—heuristics are not security boundaries.