Hackers Exploit Critical Flaws in Langflow, Ruby on Rails for Credential Theft

Threat actors are actively exploiting two critical security flaws in Langflow and Ruby on Rails, with more than 360 attacks detected in just days, according to new findings from VulnCheck published this week. The vulnerabilities allow attackers to execute arbitrary code, steal sensitive credentials including API tokens and cloud storage passwords, and potentially take full control of affected systems. The campaign highlights growing adversary interest in AI development platforms, which provide pathways to sensitive credentials and connected cloud environments.

The two flaws under attack are CVE-2026-0768, scored 9.8 out of 10 for severity, which permits execution of arbitrary Python code as the root user due to improper input validation, and CVE-2026-66066, nicknamed KindaRails2Shell and scored 9.5, which lets unauthenticated attackers read arbitrary files from servers and leak critical secrets such as the Rails master key, database passwords, and API tokens, ultimately enabling remote code execution. VulnCheck recorded just over 50 detections within hours on August 30, 2026, a count that climbed to 360 by Monday. The vulnerable Langflow systems are concentrated primarily in the United States, Germany, Malaysia, Brazil, and India, while more than 7,100 exposed Ruby on Rails instances were identified as of early August.

According to Caitlin Condon, vice president of threat research at VulnCheck, "Adversaries appear to be conducting a mix of reconnaissance and credential harvesting activities," with attacker requests querying environment variables for Langflow superuser credentials, OpenAI API keys, and AWS access secrets, reading the Langflow secret key cache, and checking SSH access and bash history size. Source traffic has predominantly originated from Russia and has exclusively targeted canaries in the United Kingdom. VulnCheck also observed threat actors leveraging CVE-2026-66066 from a single IP address in France, establishing command-and-control to a host in Israel, with attacks hitting canaries in Singapore, Israel, and the U.K. The report notes that attackers have exploited as many as 12 vulnerabilities since 2025, generating more than 15,000 successful attempts using three specific flaws including CVE-2026-0769, CVE-2025-3248, and CVE-2026-5027.

The Ruby on Rails vulnerability works by exploiting a discrepancy between Active Storage and libvips in how they read input files, requiring only that affected applications use libvips for image processing and accept image uploads from untrusted users. In observed attacks against canary systems, unknown threat actors exploited CVE-2026-5027 to deliver a Python credential harvester, proxy agents, and SimpleHelp remote access software, while separate attackers weaponized CVE-2025-3248 to recruit machines into an XMR cryptocurrency mining botnet, then disabled auditd to create a forensic blind spot before using CVE-2026-0769 to drop malicious payloads and scan for additional targets to expand their cryptomining operation. Security researcher Patrick Garrity noted the KindaRails2Shell activity originates from France with Israeli command-and-control infrastructure.

The AI platform attacks reflect a strategic shift toward development infrastructure that stores valuable credentials and provides lateral movement opportunities into cloud environments and connected systems. VulnCheck warned that Active Storage enables unsafe libvips loaders by default for any application rendering image-upload variants with the standard vips processor, allowing attackers to coerce systems into loading malicious uploads. Testing revealed that even patched version 8.1.3.1 servers block the libvips file read but fail to neutralize the Marshal deserialization component, meaning the remote code execution mechanism still functions on patched servers given a valid signature. Organizations running these platforms face immediate risk of credential compromise, lateral movement into cloud infrastructure, and full system takeover through automated exploitation at scale. The speed and sophistication of these campaigns suggest adversaries are rapidly maturing their tradecraft around AI tooling, turning development convenience into an attack surface that bypasses traditional perimeter defenses.