Full Report
Threat actors are exploiting two critical flaws impacting Langflow and Ruby on Rails, according to new findings from VulnCheck. The vulnerabilities in question are listed below - CVE-2026-0768 (CVSS score: 9.8) - A lack of proper validation of a user-supplied input vulnerability that could be exploited to execute arbitrary Python code in the context of the root user. CVE-2026-66066 aka
Analysis Summary
# Vulnerability: Critical Remote Code Execution in Langflow
## CVE Details
- **CVE ID:** CVE-2026-0768
- **CVSS Score:** 9.8 (Critical)
- **CWE:** Improper Validation of Specified Index, Action, or Responses (Input Validation)
## Affected Systems
- **Products:** Langflow (AI Development Platform)
- **Versions:** Not explicitly detailed in the text, but noted as impacting current AI stacks.
- **Configurations:** Systems where user-supplied input is processed without proper validation.
## Vulnerability Description
This flaw arises from a lack of proper validation of user-supplied input. An attacker can leverage this weakness to execute arbitrary Python code. Because the process typically runs with elevated privileges in certain deployment scenarios, the code executes in the context of the **root user**, allowing for full system compromise.
## Exploitation
- **Status:** **Exploited in the wild**. Active reconnaissance and credential harvesting have been observed (targeting environment variables and SSH keys).
- **Complexity:** Low
- **Attack Vector:** Network
## Impact
- **Confidentiality:** High (Full access to environment variables, API tokens, and SSH keys)
- **Integrity:** High (Ability to execute arbitrary code and modify system files)
- **Availability:** High (Total control over the host environment)
## Remediation
### Patches
- Users should update Langflow to the latest available version provided by the maintainers on GitHub or via package managers.
### Workarounds
- Restrict network access to Langflow instances to trusted IP addresses only.
- Avoid running Langflow as the root user; use a low-privilege service account.
- Audit environment variables for sensitive secrets (e.g., `OPENAI_API_KEY`, `AWS_ACCESS_KEY`).
## Detection
- **Indicators of compromise:**
- Unusual requests querying `LANGFLOW_SUPERUSER`, `OPENAI_API*`, `AWS_ACCESS*`, or `AWS_SECRET*`.
- Unauthorized access attempts to `/root/.cache/langflow/secret_key`.
- Sudden changes in `.bash_history` size or checks on `.ssh` directory access.
- **Detection methods and tools:** Monitor system logs for unexpected Python process execution and outbound C2 traffic (notably to IPs in Russia and France as per recent reports).
***
# Vulnerability: KindaRails2Shell (Ruby on Rails)
## CVE Details
- **CVE ID:** CVE-2026-66066
- **CVSS Score:** 9.5 (Critical)
- **CWE:** Improper Input Validation / Deserialization
## Affected Systems
- **Products:** Ruby on Rails (Active Storage)
- **Versions:** Versions prior to 8.1.3.1 (Note: Some risks remain in patched versions).
- **Configurations:** Applications using **libvips** for Active Storage image processing that accept image uploads from untrusted users.
## Vulnerability Description
The flaw stems from a discrepancy between how Rails' Active Storage and the libvips library read input files. Active Storage enables libvips loaders that are unsafe for untrusted content. Attackers can upload a crafted image to read arbitrary files from the server, leak Rails secrets (e.g., `secret_key_base`), and ultimately achieve Remote Code Execution (RCE).
## Exploitation
- **Status:** **Exploited in the wild**. Over 360 detections reported by VulnCheck, primarily originating from France/Russia.
- **Complexity:** Medium
- **Attack Vector:** Network
## Impact
- **Confidentiality:** High (Leakage of database passwords, cloud credentials, and API tokens)
- **Integrity:** High (Remote Code Execution)
- **Availability:** High
## Remediation
### Patches
- Update to **Ruby on Rails 8.1.3.1** or higher.
- **Note:** Research indicates that while 8.1.3.1 blocks the file read, the RCE gadget may still execute if a valid signature is present.
### Workarounds
- Switch image processors from libvips to ImageMagick if possible.
- Implement strict validation and sanitization of all user-uploaded images before processing.
## Detection
- **Indicators of compromise:**
- Unexpected file read attempts on sensitive Rails configuration files.
- Outbound C2 traffic to suspicious hosts (specifically identified hosts in Israel).
- **Detection methods and tools:** Use web application firewalls (WAF) to inspect image upload payloads for libvips exploitation signatures.
## References
- VulnCheck Research: hxxps[://]www[.]vulncheck[.]com/blog/pwning-the-ai-stack
- ZDI Advisory: hxxps[://]www[.]zerodayinitiative[.]com/advisories/ZDI-26-034
- The Hacker News: hxxps[://]thehackernews[.]com/2026/09/attackers-exploit-critical-langflow-and.html