Critical security flaws in Langflow and Ruby on Rails are currently being exploited by cybercriminals, as reported by VulnCheck. The two significant vulnerabilities, CVE-2026-0768 and CVE-2026-66066, have been identified as primary targets for these malicious activities.
Details of the Vulnerabilities
CVE-2026-0768, scoring 9.8 on the CVSS scale, involves inadequate validation of user inputs, allowing attackers to execute arbitrary Python code with root privileges. Meanwhile, CVE-2026-66066, known as KindaRails2Shell, has a CVSS score of 9.5 and enables unauthorized users to read server files, exposing sensitive information like database passwords and API keys, potentially leading to remote code execution.
Exploitation Tactics
Attackers exploit CVE-2026-66066 by uploading manipulated images, capitalizing on inconsistencies between Active Storage and libvips in handling input files. Successful exploitation necessitates that applications use libvips for image processing and allow uploads from unverified sources. VulnCheck observed over 50 detections in a short span on August 30, 2026, escalating to 360 detections by the following Monday.
According to Caitlin Condon from VulnCheck, adversaries are conducting reconnaissance and credential harvesting, targeting environment variables and accessing sensitive directories. Most of the source traffic originates from Russia, focusing on canaries in the U.K.
Broader Implications and Threats
Since 2025, threat actors have exploited numerous vulnerabilities, leading to over 15,000 successful breaches involving CVE-2026-0769, CVE-2025-3248, and CVE-2026-5027. The majority of Langflow’s compromised hosts are situated in the U.S., Germany, Malaysia, Brazil, and India.
In some instances, attackers have exploited CVE-2026-5027 to deploy Python-based credential harvesters and remote access tools. Other cases involved CVE-2025-3248 being used to integrate machines into cryptocurrency mining botnets.
Global Impact and Security Measures
The rising interest of threat actors in AI development platforms underscores the potential risk to sensitive credentials and cloud systems. VulnCheck has also reported active exploitation of CVE-2026-66066 affecting systems in Singapore, Israel, and the U.K., with activities traced back to an IP in France establishing command-and-control links to a host in Israel.
VulnCheck has highlighted the risks associated with the default configuration of Active Storage, which can be manipulated to run malicious uploads. Although a patch for version 8.1.3.1 addresses some issues, it does not fully neutralize all vulnerabilities, leaving systems at risk.
As of early August, over 7,100 vulnerable Ruby on Rails instances remain exposed, emphasizing the urgent need for enhanced security measures and vigilant monitoring to mitigate potential threats.
