Attackers Exploit Critical Langflow and Rails Flaws in Credential-Probing and C2 Activity

CVE-2026-0768 and Langflow

The vulnerability CVE-2026-0768, with a CVSS score of 9.8, resides within Langflow, an open-source tool for developing and managing LLM applications. This flaw stems from a lack of proper validation of user-supplied input, which attackers can leverage to execute arbitrary Python code with root privileges. This level of access is extremely dangerous, as it allows for complete compromise of the affected system.

VulnCheck's research indicates that threat actors are actively probing for and exploiting this vulnerability. Their observed activities include querying environment variables such as LANGFLOW_SUPERUSER, OPENAI_API*, and AWS_ACCESS*, as well as attempting to read sensitive files like /root/.cache/langflow/secret_key. This suggests a clear motive of credential harvesting and potentially gaining further access to cloud infrastructure.

CVE-2026-66066 and Ruby on Rails

Dubbed KindaRails2Shell, CVE-2026-66066 is a critical vulnerability in Ruby on Rails, rated at CVSS 9.5. It enables unauthenticated attackers to read arbitrary files from the server. More critically, it can leak sensitive information from the Rails process environment, including secret_key_base, the master key, database passwords, cloud storage credentials, and API tokens. This information leakage can ultimately pave the way for remote code execution.

The exploitation vector for CVE-2026-66066 involves crafting a malicious image upload. This is achieved by exploiting a discrepancy in how Active Storage and the libvips library process input files. Successful exploitation requires applications to use libvips for image processing via Active Storage and accept uploads from untrusted users. Even patched versions of Rails might remain vulnerable to certain aspects of the attack, specifically the Marshal deserialization, if a valid signature is present.

Threat Actor Activity and Scope

VulnCheck observed a significant surge in exploitation attempts shortly after the vulnerabilities were disclosed, with hundreds of detections recorded within days. The source of this malicious traffic has primarily been traced to Russia, with initial targets identified as 'canaries' in the UK. The scope of exploitation is broad, with vulnerable Langflow hosts identified across the U.S., Germany, Malaysia, Brazil, and India. In some observed instances, attackers have deployed Python credential harvesters, proxy agents, and remote access tools like SimpleHelp. Other attacks have weaponized similar vulnerabilities to enlist compromised machines into XMR cryptocurrency mining botnets, often disabling auditing tools to cover their tracks.

The findings underscore a heightened interest from threat actors in AI development platforms, recognizing their potential as gateways to valuable credentials, cloud environments, and interconnected systems. The active exploitation of these flaws presents a clear and present danger to organizations relying on these technologies.