Ruby on Rails Vulnerability CVE-2026-66066 Actively Exploited, Affecting 7,000 Instances

Active Exploitation of Critical Rails Flaw

A critical Ruby on Rails vulnerability, tracked as CVE-2026-66066 and dubbed KindaRails2Shell, is currently being exploited by attackers. This flaw, with a CVSS score of 9.5, enables remote code execution (RCE) and arbitrary file reading, potentially leading to secret exposure and lateral movement within affected systems.

Vulnerability Details and Patching

The security defect was disclosed in late July, at which point Ruby on Rails released patches. The vulnerability affects Rails applications that utilize libvips for Active Storage image processing and allow image uploads from untrusted users. Security researchers reverse-engineered the bug shortly after disclosure, releasing technical information and proof-of-concept code, prompting Rails to publish forensic tools for detection.

Mechanism of Attack

KindaRails2Shell stems from a discrepancy in how different libraries interpret file types. While Rails might rely on client-supplied content types, libvips determines file types based on magic bytes. This allows an attacker to craft a file declared as MATLAB Level 5, which then routes through libmatio and HDF5. HDF5's External File List feature can then be manipulated to read an attacker-chosen file from the server, returning its contents as pixels. This confusion at multiple layers allows an unauthenticated attacker to read sensitive files, including credential databases and storage keys, which can then be used to forge sessions and execute arbitrary code.

Ongoing Risk and Impact

VulnCheck reported that threat actors initiated exploitation of CVE-2026-66066 last week, approximately one month after patches became available. Furthermore, VulnCheck's tests indicate that even on a patched 8.1.3.1 server, while the libvips file read is blocked, the variation-key Marshal deserialization component, which is an RCE gadget, can still execute if provided a valid signature. In early August, VulnCheck identified approximately 7,000 exposed Ruby on Rails instances vulnerable to KindaRails2Shell.