Attackers Exploit Critical Langflow and Rails Flaws in Credential-Probing and C2 Activity
Two critical vulnerabilities are being actively exploited: CVE-2026-0768 (CVSS 9.8) in Langflow, allowing unauthenticated arbitrary Python code execution as root, and CVE-2026-66066 (CVSS 9.5) in Ruby on Rails, enabling file reads, secret leakage, and remote code execution Threat actors are conducting credential harvesting and reconnaissance, targeting environment variables (LANGFLOW_SUPERUSER, OPENAI_API keys, AWS credentials), reading secret keys, and checking SSH access and bash history Attac
Analysis
TL;DR
- Two critical vulnerabilities are being actively exploited: CVE-2026-0768 (CVSS 9.8) in Langflow, allowing unauthenticated arbitrary Python code execution as root, and CVE-2026-66066 (CVSS 9.5) in Ruby on Rails, enabling file reads, secret leakage, and remote code execution
- Threat actors are conducting credential harvesting and reconnaissance, targeting environment variables (LANGFLOW_SUPERUSER, OPENAI_API keys, AWS credentials), reading secret keys, and checking SSH access and bash history
- Attackers are deploying Python credential harvesters, proxy agents, SimpleHelp for remote access, disabling auditd for forensic evasion, and enlisting compromised hosts into XMR cryptocurrency miner botnets
- Over 7,100 exposed Ruby on Rails instances and thousands of vulnerable Langflow hosts have been identified, with the majority located in the U.S., Germany, Malaysia, Brazil, and India
- A patched Rails version (8.1.3.1) blocks the libvips file read but does not neutralize the variation-key Marshal deserialization RCE gadget, meaning the vulnerability remains partially exploitable even after patching
Why It Matters
This represents a significant escalation in threat actor interest targeting AI development platforms, which serve as high-value entry points due to their access to sensitive credentials, cloud environments, and connected systems. The partial ineffectiveness of the Rails patch underscores the importance of defense-in-depth strategies, as relying solely on vendor patches may leave organizations exposed to ongoing exploitation.
Technical Details
- CVE-2026-0768 (Langflow, CVSS 9.8): A user-supplied input validation flaw that allows unauthenticated attackers to execute arbitrary Python code in the context of the root user on affected Langflow deployments
- CVE-2026-66066 / KindaRails2Shell (Ruby on Rails, CVSS 9.5): Exploits a discrepancy between Active Storage and libvips in how they read input files; requires applications to use libvips for Active Storage image processing and accept untrusted image uploads. Successful exploitation leaks environment variables, secret_key_base, master keys, database passwords, cloud credentials, and API tokens, leading to RCE
- Attack chain observed: Threat actors exploit CVE-2026-5027 to deploy credential harvesters and proxy agents, disable auditd to create forensic blind spots, exploit CVE-2026-0769 to drop .sysd payloads, pivot to scan for additional targets, and exploit CVE-2025-3248 to enlist hosts into XMR mining botnets
- Patch limitation: Testing of Rails 8.1.3.1 confirmed that while the libvips file read is blocked, the variation-key Marshal deserialization RCE gadget still executes on patched servers when given a valid signature
- Detection scale: VulnCheck recorded over 50 detections within hours of the August 30, 2026 disclosure, rising to 360 detections, with source traffic primarily originating from Russia and a single IP address in France establishing C2 to a host in Israel
Industry Insight
- Organizations running Langflow or Ruby on Rails should immediately audit their deployments for exposure, prioritize patching, and implement network segmentation to limit lateral movement, especially since the Rails patch is incomplete and additional mitigation layers are required
- AI development platforms should be treated as high-value targets requiring hardened security configurations, including restricted network access, credential isolation, and continuous monitoring for anomalous environment variable queries and unauthorized file access patterns
- The sustained and sophisticated attack campaigns—spanning credential theft, cryptomining, and persistent backdoor deployment—indicate that threat actors are systematically targeting the AI infrastructure supply chain, prompting organizations to adopt zero-trust architectures and assume breach postures for all externally exposed AI development tools
Disclaimer: The above content is generated by AI and is for reference only.