CVE-2025-62593

COMPONENT VERSION RANGE

NewScan fingerprints Ray from its response and reports this CVE when the detected version falls inside the affected range below.

Added 2026-08-23 with the Ray fingerprint it was waiting on (the tech_signatures body row capturing ray_version in-band from /api/version). Before 2.52.0 the dashboard gated the Jobs API only on a User-Agent starting with 'Mozilla' - forgeable by fetch() in Firefox and Safari, so a developer's browser can be driven (DNS rebinding or a hostile page) against a dashboard bound to localhost, and a network-reachable dashboard is strictly worse than that case. CISA KEV. Version range from the 2.52.0 release that added token auth (RAY_AUTH_MODE=token), measured 2026-08-18 on both builds: 2.51.0 open anonymously, 2.52.0 answering 401 with token auth on. The interfaces /api/version row claims the same id as its PRECONDITION (the open-Jobs-API posture, any version); this row is the version-matched advisory arm, and the two deliberately do not need each other.