Attackers Exploit Critical Langflow and Rails Flaws in Credential-Probing and C2 Activity

Summary

VulnCheck reports active in-the-wild exploitation of two critical vulnerabilities: CVE-2026-0768 (CVSS 9.8) in Langflow, which enables arbitrary Python code execution as root, and CVE-2026-66066 (CVSS 9.5, aka KindaRails2Shell) in Ruby on Rails, which enables unauthenticated arbitrary file read, secret leakage, and remote code execution.^[0][28][29]

Detections against VulnCheck canaries surged from over 50 within hours on August 30, 2026 to 360 by the following Monday, with attackers conducting reconnaissance and credential harvesting by probing environment variables and secret files. No named threat actor is attributed; Langflow probing traffic primarily originates from Russia while Rails exploitation traces to a single IP in France with C2 to a host in Israel.^[0]

The activity reflects broadening threat-actor interest in AI development platforms as high-value targets for cloud credentials and connected systems, alongside historical exploitation of related Langflow flaws for credential theft, proxy deployment, remote access, and cryptomining.^[0]

Attack chain

1. Reconnaissance and credential harvesting: Attacker requests against Langflow query environment variables such as LANGFLOW_SUPERUSER, OPENAI_API*, AWS_ACCESS*, and AWS_SECRET*, read /root/.cache/langflow/secret_key, and check .ssh access and .bash_history size.^[0]
2. Exploitation for RCE: CVE-2026-0768 permits arbitrary Python code execution as root in Langflow; CVE-2026-66066 is exploited by uploading a crafted image abusing the discrepancy between Active Storage and libvips to read files, leak secrets, and ultimately achieve RCE.^[0]
3. Command-and-control: For the Rails exploitation, activity from a single French IP establishes command-and-control to a host located in Israel.^[0]
4. Post-exploitation (historical related campaigns): In prior VulnCheck canary observations, attackers used CVE-2026-5027 to drop a Python credential harvester, proxy agents, and SimpleHelp for remote access, and used CVE-2025-3248 to enlist hosts into an XMR miner botnet, disabling auditd to create a forensic blind spot before pivoting to scan for further targets.^[0]

Disclosure timeline

How it works

CVE-2026-0768 is a lack of proper validation of user-supplied input in Langflow that could be exploited to execute arbitrary Python code in the context of the root user.^[0][28]

CVE-2026-66066 is exploited by uploading a crafted image that abuses the discrepancy between Active Storage and libvips in how they read input files. Active Storage always enables the libvips loaders unsafe for untrusted content, so any app rendering image-upload variants with the default vips processor can be coerced into loading a malicious upload; successful exploitation requires libvips-based Active Storage image processing and acceptance of uploads from untrusted users.^[0][29]

The Rails flaw can leak the Rails process environment and secrets such as secret_key_base, the Rails master key, database passwords, cloud storage credentials, and API tokens, ultimately leading to remote code execution. VulnCheck found that the 8.1.3.1 patch blocks the libvips file read but does not neutralize the variation-key Marshal deserialization, so the RCE gadget still executes on a patched server given a valid signature.^[0]

Affected versions and patch status

Indicators of Compromise

Key takeaways

• AI development platforms like Langflow are increasingly targeted because they provide access to sensitive credentials, cloud environments, and connected systems.^[0]
• A vendor patch may not fully close an attack path: Rails 8.1.3.1 blocks the libvips file read but leaves the Marshal deserialization RCE gadget exploitable with a valid signature.^[0]

Defensive actions

• Patch or restrict Langflow instances vulnerable to CVE-2026-0768 and rotate exposed credentials.: Attackers execute arbitrary Python as root and harvest environment variables and secret files such as /root/.cache/langflow/secret_key.^[0]
• For Ruby on Rails, disable or replace the vulnerable libvips-based Active Storage image processing path and treat 8.1.3.1 as insufficient.: VulnCheck confirmed the 8.1.3.1 patch does not neutralize the variation-key Marshal deserialization RCE gadget, which still executes given a valid signature.^[0]
• Rotate secret_key_base, the Rails master key, database passwords, cloud storage credentials, and API tokens on potentially exposed Rails apps.: CVE-2026-66066 can leak these secrets from the Rails process environment, enabling further compromise and RCE.^[0]
• Monitor for tampering with auditing (e.g., disabling auditd) and unexpected outbound C2 connections.: Attackers disabled auditd in a related campaign to create a forensic blind spot, and Rails exploitation establishes C2 to an external host.^[0]