Researchers have uncovered active exploit campaigns targeting two high-severity vulnerabilities affecting Langflow and Ruby on Rails that are being used for credential theft, environment scanning, and remote code execution (RCE). These findings come from threat intelligence firm VulnCheck, which observed rapid weaponization of the flaws following public disclosure.
What Are the Flaws?
The first flaw, CVE-2026-0768, carries a CVSS score of 9.8 and arises from insufficient validation of user-supplied input in Langflow. Attackers can exploit it to execute arbitrary Python code with root privileges. Meanwhile, CVE-2026-66066—dubbed “KindaRails2Shell”—score 9.5, impacts Ruby on Rails, and allows unauthenticated actors to read sensitive files (including environment settings, master keys, API tokens), before pivoting to remote execution.
In the case of CVE-2026-66066, exploitation hinges on applications using libvips with Active Storage for image processing. An attacker can deliver a carefully crafted image upload, because libvips and Active Storage differ in how they handle untrusted content. Even patched servers (specifically 8.1.3.1) remain vulnerable under certain signatures: the fix stops file reads by libvips but fails to neutralize a RCE gadget tied to marshaled variation-keys.
Scale and Tactics of the Attackers
More than 50 incidents exploiting these flaws were detected within just a few hours on August 30, 2026. By early September, that number had ballooned to over 360 reported detections. Most affected Langflow hosts are located in the United States, Germany, Malaysia, Brazil, and India.
Attackers are probing for credentials by querying environment variables (for example, OPENAI_API, AWS_ACCESS, SECRET keys), reading Langflow cache and SSH/Bash history files, and inspecting superuser configurations. In several cases, actors dropped credential harvesters, proxy agents, and even cryptomining software. They also disabled system auditing tools like auditd to hide their tracks and used CVE-2026-0769 to gain persistent access.
Tests show the campaign is global. Canary systems in the UK, Singapore, and Israel have all been attacked. IP tracking suggests much of the scanning originates from Russia, though certain C2 communications are routed through a French IP to a host in Israel.
Implications for AI Platforms and Rails Users
This attack wave highlights a growing trend: threat actors increasingly target AI development tools and frameworks. Langflow, which facilitates building and orchestrating AI pipelines, and Ruby on Rails, a widely used web framework, are attractive targets because breaches can expose deep system credentials and cloud resources.
VulnCheck identified over 7,100 exposed Rails instances vulnerable to these issues by early August. Existing applications that accept image uploads and rely on default processors like libvips are especially at risk. Organizations using Langflow should examine their input validation, access controls, and secrets management immediately.
Ultimately, these recent incidents reinforce the need for development teams to stay ahead of patching, properly sandbox uploads, and isolate credentials from code and environment wherever possible.
Analytical Take: The speed and scale of these exploit campaigns show how quickly attackers discover and weaponize gaps in popular tools—especially those tied to AI. What’s notable is not just the severity of the vulnerabilities, but how subtle some of them are: leveraging image processing, default behavior like marshaled data deserialization, and credentials stored in environment variables. This underlines that even seemingly familiar frameworks or utilities—Rails’ Active Storage or AI-pipeline tools—can harbor serious threats. Going forward, defenders need to standardize threat modeling for AI tools, bake in secure defaults for data and image handling, and assume that any environment variable or file could be leveraged if exposed. Stay alert to updates from both Langflow and Rails projects, and assume adversaries are already testing locally before attacks hit.
