Langflow and Ruby on Rails — Massive Exploitation of Critical RCE and File Read Flaws in AI and Web Development Frameworks (CVE-2026-0768 / CVE-2026-66066)

Publication date: September 1, 2026
Category: Vulnerability / Artificial Intelligence / Defensive Security

Introduction

Malicious actors have focused their efforts on actively exploiting a set of critical vulnerabilities affecting Artificial Intelligence development platforms like Langflow and enterprise web frameworks such as Ruby on Rails. According to recent reports from threat intelligence firm VulnCheck, an exponential surge in detections has been recorded involving credential probing, corporate secret exfiltration, and command and control (C2) infrastructure deployment. This campaign highlights the growing attractiveness of AI environments as initial access vectors into corporate cloud setups and highly sensitive systems.

What is Langflow and Ruby on Rails? (General Analysis)

Langflow is a Python-based visual interface engineered to build AI applications, agent workflows, and natural language processing chains. Meanwhile, Ruby on Rails is a widely adopted web development framework utilizing Active Storage for file upload management.

Compromising these platforms represents a critical risk because they frequently operate with elevated privileges or store master credentials and environment variables for connected services (such as OpenAI, AWS, databases, and API tokens). Below is a summary of the official vectors and classifications associated with the primary vulnerabilities:

  • CVE-2026-0768: Code injection vulnerability in Langflow. Allows remote unauthenticated attackers to execute arbitrary Python code. (CVSS: 9.8 Critical | CWE-94 | NVD Confirmed Data).
  • CVE-2026-66066 (KindaRails2Shell): Arbitrary file read in Action Pack / Active Storage of Ruby on Rails. Permits unauthenticated attackers to read system files, environment variables, and secrets. (CVSS: 9.5 Critical | CWE-1188 | NVD Confirmed Data).
  • CVE-2026-0769: Eval injection vulnerability in Langflow custom components. (CVSS: 9.8 Critical | CWE-95 | NVD Confirmed Data).
  • CVE-2025-3248: Code injection vulnerability in Langflow /api/v1/validate/code endpoint (Listed in CISA KEV). (CVSS: 9.8 Critical | CVE-306, CWE-94 | NVD Confirmed Data).
  • CVE-2026-5027: Path traversal vulnerability in Langflow file upload endpoint. (CVSS: 8.8 High | CWE-22 | NVD Confirmed Data).

How Does It Work? (Technical Analysis)

The active campaign observed by security analysts combines multiple exploitation and post-exploitation techniques to maximize impact across exposed systems:

  • Initial Infection Flow and Exploit Entry:
    • In Langflow: Attackers submit unauthenticated malicious HTTP requests to vulnerable endpoints such as /api/v1/validate/code (leveraging CVE-2026-0768 and CVE-2025-3248) or manipulate code evaluation routines (CVE-2026-0769). The lack of proper sanitization on user-supplied strings enables direct execution of Python exec/eval functions, inheriting process or root privileges. Additionally, CVE-2026-5027 abuses the filename parameter in multipart forms to write files to arbitrary filesystem locations using directory traversal sequences (../).
    • In Ruby on Rails (CVE-2026-66066): The flaw stems from a discrepancy between Active Storage and the libvips image processor. Active Storage does not disable libvips operations marked as unsafe for untrusted content by default. By uploading a crafted image, an unauthenticated attacker can coerce the Rails process into reading arbitrary files accessible to the application.
  • Persistence, Privilege Escalation, and Credential Harvesting:
    • Adversaries conduct automated reconnaissance actively querying critical environment variables (LANGFLOW_SUPERUSER, OPENAI_API*, AWS_ACCESS*, AWS_SECRET*), reading secret cache files (/root/.cache/langflow/secret_key), parsing command histories (.bash_history), and checking SSH access.
    • In cases observed against canary systems, attackers disabled kernel auditing tools like auditd to create a forensic blind spot, deployed Python-based credential harvesters, proxy agents, and remote access tools (SimpleHelp), or enlisted compromised machines into an XMR cryptocurrency miner botnet.
    • Notably, supplemental research indicates that initial patches released for specific Ruby on Rails versions block libvips file reads, but under certain conditions, variation-key Marshal deserialization may still allow RCE gadget execution given a valid payload signature.

Affected Systems / Environments

Impacted environments include internet-exposed servers running unpatched versions of the aforementioned frameworks, with high concentrations of vulnerable nodes located in the United States, Germany, Malaysia, Brazil, India, the United Kingdom, Israel, and France.

CVE Category (CWE) Impact CVSS Vector (summarized)
CVE-2026-0768 CWE-94 (Code Injection) RCE as root 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2026-66066 CWE-1188 (Insecure Default) File Read / RCE 9.5 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/…
CVE-2026-0769 CWE-95 (Eval Injection) RCE 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2025-3248 CWE-306 / CWE-94 Unauth RCE 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2026-5027 CWE-22 (Path Traversal) Arbitrary File Write 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Mitigation and Detection

Remediation

  • Priority Patching: Immediately apply official patches provided by developers. For Ruby on Rails, update to secure versions 7.2.3.2, 8.0.5.1, or 8.1.3.1 (or higher), which resolve the insecure handling of libvips in Active Storage. For Langflow, upgrade to version 1.3.0 or higher.
  • Network Exposure Restriction: Ensure that AI development interfaces and Langflow administration panels are not directly exposed to the public internet without robust multi-factor authentication (MFA) and strict network segmentation via corporate VPNs.
  • Dependency Auditing: Review image processing configurations in web applications to disable unsafe processors or loaders if they are not strictly required.

Detection

Security teams should monitor access logs for anomalous HTTP requests targeting code validation and file upload endpoints, alongside unauthorized access attempts to application environment variables.

“Adversaries are conducting automated operations focused on rapid reconnaissance and credential harvesting across the AI stack, disabling logging tools to conceal their footprint and integrating vulnerable hosts into cryptomining networks.”

yaml 
# Conceptual detection rule for suspicious request patterns
title: Detection of Exploitation Attempts Against Langflow and Rails Endpoints
id: 9b8f2c3d-7e1a-4f5b-9c2d-1a2b3c4d5e6f
status: experimental
description: Detects suspicious HTTP requests directed toward vulnerable code validation or file upload endpoints.
logsource:
  category: webserver
  product: nginx
detection:
  selection:
    uri|contains:
      - "/api/v1/validate/code"
      - "/api/v2/files"
    method: "POST"
  condition: selection
falsepositives:
  - Legitimate testing environments or authorized CI/CD tooling.
level: high

Wrapping Up

The recent exploitation campaign targeting Langflow and Ruby on Rails demonstrates how threat actors rapidly adapt their tactics to compromise emerging AI-driven platforms and established web frameworks. With critical CVSS scores reaching up to 9.8 and verified evidence of credential exfiltration, malware deployment, and cryptomining, organizations must promptly deploy patches, enhance audit log visibility, and limit public exposure of critical development services.

References