Langflow and Ruby on Rails — Active Exploitation of Critical AI and Web Framework Vulnerabilities (CVE-2026-0768)

Publication date: September 1, 2026
Category: Vulnerability / Threat Intelligence / Cybersecurity

Introduction

Threat intelligence researchers at VulnCheck have issued a critical warning regarding an active exploitation campaign targeting multiple high-impact vulnerabilities in Artificial Intelligence development platforms (Langflow) and enterprise web application frameworks (Ruby on Rails). Threat actors are leveraging code injection and arbitrary file read flaws to conduct automated reconnaissance, mass probing of credentials stored in environment variables and developer infrastructure, and the deployment of command-and-control (C2) agents, cryptominers, and credential harvesters. This development highlights the expanding attack surface associated with corporate AI tooling and underlying web infrastructure.

What is KindaRails2Shell and Langflow Vulnerabilities? (General Analysis)

The analyzed threat landscape primarily centers around two recent critical flaws: CVE-2026-0768 (in Langflow) and CVE-2026-66066 (in Ruby on Rails, designated as KindaRails2Shell), alongside historical and recent vectors such as CVE-2026-0769, CVE-2025-3248, and CVE-2026-5027.

Langflow is a Python-based graphical user interface designed for building generative AI applications and Large Language Model (LLM) agents. By handling custom components and execution flows, it exposes internal APIs that, when lacking strict input validation, enable direct execution of arbitrary code. Meanwhile, Ruby on Rails is a robust web framework utilizing Active Storage for file attachments; a discrepancy in image processing via underlying libraries like libvips bypasses security controls on untrusted content.

Official NVD metrics for the primary CVEs involved include:

  • CVE-2026-0768: Langflow Code Injection Remote Code Execution Vulnerability (insufficient validation of user-supplied input in the /validate endpoint code parameter). Allows unauthenticated remote code execution.

    • Official CVSS: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — 9.8 (CRITICAL) [NVD Confirmed Fact].
    • Official CWE: CWE-94 (Improper Control of Generation of Code) [NVD Confirmed Fact].

  • CVE-2026-66066 (KindaRails2Shell): Active Storage in Ruby on Rails fails to disable unsafe libvips operations for untrusted content, allowing crafted uploads to invoke file reads.

    • Official CVSS: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/... — 9.5 (CRITICAL) [NVD Confirmed Fact].
    • Official CWE: CWE-1188 (Insecure Default Initialization of Resource) [NVD Confirmed Fact].

  • CVE-2025-3248: Unauthenticated code injection in Langflow’s /api/v1/validate/code endpoint.

    • Official CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — 9.8 (CRITICAL) [NVD Confirmed Fact].
    • Official CWE: CWE-306, CWE-94 [NVD Confirmed Fact]. Note: Listed in CISA KEV catalog.

How Does It Work? (Technical Analysis)

The detected campaign stands out for its automation and the variety of payloads deployed depending on the exploited vector:

  • Ruby on Rails Exploitation Flow (CVE-2026-66066): Attackers submit a crafted image taking advantage of input-reading discrepancies between Active Storage and libvips. This allows an unauthenticated attacker to read arbitrary files from the server, leaking environment variables (secret_key_base, Rails master key, database passwords, and cloud storage credentials like AWS or OpenAI tokens). The exposure of these secrets paves the way for remote code execution or lateral movement.
  • Langflow Exploitation Flow (CVE-2026-0768 / CVE-2025-3248 / CVE-2026-0769): Through unauthenticated HTTP requests targeting component validation and evaluation endpoints, attackers inject and execute arbitrary Python code with elevated privileges (often root context).
  • Post-Exploitation and C2 Activities: VulnCheck documented hundreds of detections focused on credential probing (querying LANGFLOW_SUPERUSER, OPENAI_API*, AWS_ACCESS*, reading /root/.cache/langflow/secret_key, and reviewing bash history). On canary systems, observers noted the execution of Python credential harvesters, proxy agents, remote access software (SimpleHelp), persistence via .sysd, disabling auditd to create forensic blind spots, and XMR cryptocurrency miner botnets.

“Adversaries appear to be conducting a mix of reconnaissance and credential harvesting activities: Among other things, attacker requests are querying environment variables and reading secret keys.” — Caitlin Condon, VulnCheck

Affected Systems / Environments

Vulnerabilities affect global deployments concentrated heavily in the U.S., Germany, Malaysia, Brazil, and India, with canary hits recorded in the U.K., Singapore, and Israel.

CVECategory (CWE)ImpactCVSSVector (Summary)
CVE-2026-0768CWE-94 (Code Injection)RCE (Root Context)9.8Network / No Auth / Low Complexity
CVE-2026-66066CWE-1188 (Insecure Default)File Read / RCE9.5Network / No Auth / libvips Dependency
CVE-2025-3248CWE-94 / CWE-306RCE / CISA KEV9.8Network / No Auth / Active Mass Exploitation
CVE-2026-5027CWE-22 (Path Traversal)File Write8.8Network / Low Priv Auth

Mitigation and Detection

Remediation

  • Ruby on Rails Update: Immediately apply official patches by upgrading Rails to versions 7.2.3.2, 8.0.5.1, and 8.1.3.1, which properly restrict unsafe libvips operations in Active Storage.
  • Langflow Update: Update Langflow to versions beyond 1.3.0 where vulnerable code validation endpoints are secured.
  • AI Environment Hardening: Isolate containers and execution runtimes for AI services, strictly limiting access to sensitive environment variables (such as API keys and master tokens) by enforcing the principle of least privilege.

Detection

Defensive teams must actively monitor access logs for anomalous HTTP requests targeting code validation endpoints (/api/v1/validate/code) or malformed multipart form data uploads in Active Storage. Supervision is advised for unexpected file reads under hidden application directories (e.g., /root/.cache/langflow/secret_key) and unauthorized modifications to system services or auditing daemons (auditd).

Wrapping Up

The rapid exploitation of critical vulnerabilities in AI frameworks (Langflow) and mature web platforms (Ruby on Rails) demonstrates that the modern attack surface quickly encompasses development and automation tooling. With hundreds of probing and exfiltration attempts registered within hours, organizations must prioritize patch management and visibility across development and production environments to prevent credential compromise and malicious infrastructure deployment.

References