Get on Slack/Teams RSS
Last updated: August 19, 2026 at 1:47 AM UTC
All 741 Vulnerability 286 Breach 129 Threat 319 Defense 7
Tag: ai-infrastructure (3 articles)Clear
vulnerability
CVE-2025-62593
2026-08-19

CISA flags exploited Ray flaw that lets a website run code on developer machines

CISA added a critical flaw in Ray, the open-source framework for scaling AI and machine-learning workloads, to its exploited-vulnerabilities catalog and gave federal agencies just three days to fix it. Tracked as CVE-2025-62593 and scored 9.4, the bug stems from Ray leaving key dashboard and job endpoints unauthenticated; its only browser defense checked that the request's user-agent began with Mozilla, which attackers can forge. Combined with a DNS rebinding attack, a malicious website or advertisement viewed while running Ray can execute code on the developer's machine. A DDoS botnet adopted it before public disclosure, and a separate campaign has been turning unpatched Ray clusters with GPUs into cryptocurrency miners.

rayai-infrastructuredns-rebindingbrowser-rceactively-exploited
Check
Upgrade Ray to version 2.52.0 or later, and treat the risk as immediate given the three-day federal deadline and ongoing campaigns against exposed clusters, including developer machines running Ray locally.
Affected
Anyone running Ray before 2.52.0 (CVE-2025-62593); unauthenticated dashboard endpoints plus a browser and DNS rebinding attack let a malicious page run code on the machine, and it is exploited in the wild.
Fix
Patch to 2.52.0, keep Ray dashboards and APIs off untrusted networks and behind authentication, restrict who can reach them, and check GPU clusters for unauthorized cryptomining and other signs of compromise.
threat
2026-07-20

NadMesh botnet scans for exposed AI services to steal cloud and cluster keys

Researchers at XLab detailed NadMesh, a Go based botnet spreading since early July that hunts exposed AI and automation services rather than raw computing power. A reconnaissance module queries a public device search engine for internet facing instances of tools like Ollama, ComfyUI, n8n, Open WebUI, Langflow, and Gradio, then works through more than twenty exploitation paths. What it ships home is credentials: cloud access keys pulled from environment variables, Kubernetes service account tokens, and the contents of files like .env and Docker configuration. Callable tool endpoints on AI integration servers sit at the top of the operator's priority list, above Kubernetes and exposed Docker APIs.

nadmeshbotnetai-infrastructurecloud-credentialskubernetes
Check
Check whether any AI or automation services are reachable from the internet, especially Ollama, ComfyUI, n8n, Langflow, or Gradio, plus open Docker APIs, Jenkins consoles, and unauthenticated Redis.
Affected
Teams running self-hosted AI and automation tooling exposed online; NadMesh harvests cloud access keys, Kubernetes service account tokens, and AI integration tool access, targeting the credentials rather than the host.
Fix
Put AI and automation services behind authentication or off the public internet, scope cloud and Kubernetes credentials tightly, avoid long lived keys in those workloads, and rotate anything exposed.
vulnerability
CVE-2026-33626
2026-04-24

LMDeploy LLM-serving SSRF (CVE-2026-33626) exploited within 13 hours of disclosure - attackers used the vision-language image loader as a generic port-scanner against AWS metadata, Redis, and MySQL

Sysdig observed the first in-the-wild exploitation of CVE-2026-33626 against its honeypot fleet 12 hours and 31 minutes after the GitHub advisory went live on April 21. LMDeploy is Shanghai AI Laboratory's open source toolkit for serving vision-language and text LLMs. The flaw is in load_image() in lmdeploy/vl/utils.py: it fetches arbitrary URLs from the image_url field without validating link-local, loopback, or RFC1918 ranges. CVSS 7.5. The attacker used LMDeploy as a generic SSRF primitive over an eight-minute session - port-scanning AWS IMDS, localhost Redis, MySQL, and an admin interface. v0.12.3 fixes it.

lmdeployssrfai-infrastructurellm-servingimdsfast-exploitationsysdigvision-language
Check
If your team runs LLM-serving infrastructure (LMDeploy, vLLM, TGI, Ollama, Ray Serve), audit it this week for unvalidated URL fetching and put proper egress filtering in place.
Affected
LMDeploy versions before 0.12.3 with vision-language support enabled. Cloud GPU inference deployments are at acute risk because the SSRF directly targets the metadata service - on a misconfigured node this yields IAM credentials with broad access to S3 model artifacts, training data, and cross-account roles.
Fix
Upgrade LMDeploy to 0.12.3+. On every cloud-hosted inference node, enforce IMDSv2 with token requirement (this alone defeats IAM exfil). Restrict outbound egress from GPU nodes to required destinations only. Block 169.254.169.254 from inference containers without a use case. Apply the same logic to vision-LLM image loaders, agent tool-use endpoints, and RAG fetchers. Block 103.116.72[.]119 at the edge.