Active exploitation of Ruby on Rails Active Storage vulnerability

Threat summary

On August 31, 2026, researchers reported active exploitation of a critical vulnerability affecting Ruby on Rails Active Storage. The activity was observed against internet-facing systems approximately one month after security updates became available and shortly after public proof-of-concept code and technical details were released.

Ruby on Rails is a widely used open-source web application framework used in customer portals, software-as-a-service platforms, business applications, and other web services. Active Storage is the framework's built-in component for file uploads and attachments.

The vulnerability, tracked as CVE-2026-66066 and nicknamed KindaRails2Shell by researchers, was disclosed and patched by Ruby on Rails on July 29, 2026. Security updates were released in Rails 7.2.3.2, 8.0.5.1, and 8.1.3.1. The flaw carries a CVSS score of 9.5.

CVE-2026-66066 is an arbitrary file read vulnerability that affects applications that use the Active Storage file upload component with the libvips image processing library and allow users to upload image files. Applications configured to use ImageMagick for image processing are not affected by the vulnerability.

A threat actor can upload a specially crafted file that causes Active Storage and libvips to process the file in an unintended way, allowing access to files that the Rails application is permitted to read. Those files can include application secrets, database credentials, cloud storage credentials, and the Rails secret_key_base, which is used to secure sessions and other sensitive application functions.

The POC demonstrated how credentials and secrets exposed through CVE-2026-66066 can be leveraged after the initial file disclosure. Researchers showed that stolen secrets may enable session forgery, access to connected services, and remote code execution in affected environments, creating a path from information disclosure to broader compromise.

Analysis

CVE-2026-66066 affects a common deployment model used by modern Rails applications. Active Storage is the framework's built-in file upload component, and libvips has been the default image processor in Rails 7.x and later releases.

The vulnerability also affects a function that organizations intentionally expose to external users. Unlike vulnerabilities that require administrative access or access to internal services, CVE-2026-66066 can be triggered through image upload functionality when the documented exposure conditions are present.

The significance of the vulnerability comes from the type of information commonly stored within modern application environments. Application secrets, cloud credentials, database credentials, API keys, and signing keys often provide access to systems beyond the application itself. In many environments, the exposure of these credentials presents a greater risk than compromise of the web application alone because the same credentials may provide access to data stores, cloud resources, and supporting services.

The POC demonstrated how exposed secrets can be leveraged to advance an attack and achieve remote code execution in affected environments. While the vendor’s stated impact is arbitrary file disclosure, the research shows how compromise can extend beyond information disclosure when valuable credentials are accessible to the application process. The potential for escalation, combined with public exploit availability and observed exploitation activity, increases the urgency of patching internet-facing deployments.

This vulnerability allows an initial information disclosure that leads to credential theft, access to connected services, and broader compromise of the environment. For organizations running affected Rails applications, the primary concern is not only the application server itself, but also the systems and services accessible through credentials stored within the application environment.

Mitigations

The first step in the review process is identifying Ruby on Rails applications that use Active Storage with the libvips image processor and determining whether they accept image uploads from untrusted users. These conditions define the attack surface described in the advisory, making internet-facing applications and customer-facing upload functionality the primary focus of response efforts.

Patching efforts should focus on upgrading affected deployments to Rails 7.2.3.2, 8.0.5.1, or 8.1.3.1 and verifying that libvips version 8.13 or later is installed. The Rails advisory identifies both components as part of the fix because the vulnerability stems from how Active Storage interacts with libvips during image processing.

Application secrets, database credentials, cloud storage credentials, service account credentials, and the Rails secret_key_base should also receive attention during remediation. CVE-2026-66066 provides access to files readable by the application process, and those files may contain credentials that provide access to databases, cloud services, and other connected systems. Rails recommends rotating exposed secrets after patching because security updates address the vulnerability itself while credentials exposed before patching remain valid.

Reviewing application and web server logs for unusual file upload activity, attempts to access sensitive files, and signs of post-exploitation activity could help reduce the risk even further. Researchers have reported exploitation targeting internet-facing systems, making log review and credential validation important parts of assessing potential exposure and determining whether follow-on activity occurred after compromise.

Stay on top of emerging threats like this.

Sign up to receive a weekly roundup of our security intelligence feed. You'll be the first to know of emerging attack vectors, threats, and vulnerabilities. 

Sign up