Critical Ruby on Rails Vulnerability in Attackers’ Crosshairs
A critical Ruby on Rails vulnerability (CVE-2026-66066) is being actively exploited by threat actors, allowing for remote code execution and potential data exposure. Despite patches being released in late July, approximately 7,000 vulnerable Rails instances remain exposed, highlighting the ongoing challenge of patching legacy systems. The vulnerability stems from a confusion between file types, enabling attackers to read arbitrary files and execute malicious code.
A critical Ruby on Rails vulnerability, tracked as CVE-2026-66066 and nicknamed KindaRails2Shell, is currently being exploited by threat actors. The vulnerability allows for remote code execution (RCE) and potential secret exposure. The flaw originates from a confusion between how Ruby on Rails interprets file types, specifically when dealing with Active Storage image processing using libvips.
Libvips, when processing client-supplied content types, relies on magic bytes to determine the file type. An attacker can craft a file and declare it as MATLAB Level 5, leading libvips to select the MATLAB loader. This then routes the file through libmatio, which identifies MAT 7.3 in a header field and hands it to HDF5.
HDF5’s External File List allows a dataset’s bytes to live in another file named by path and offset, so rendering the ‘image’ reads an attacker-chosen file off the server and returns its contents as pixels. This process repeats at two layers, with neither layer recognizing the other’s fields.
Threat actors began exploiting the vulnerability last week, approximately one month after patches were released. VulnCheck’s testing on a patched 8.1.3.1 server revealed that while the fix blocks the libvips file read, it does not neutralize the variation-key Marshal deserialization – the RCE gadget still executes on a patched server given a valid signature.
In early August, VulnCheck identified around 7,000 exposed Ruby on Rails instances vulnerable to KindaRails2Shell. The vulnerability could allow an unauthenticated attacker to target anything that the Rails process can read, including the credential database and storage keys, enabling them to forge sessions, access additional systems, and execute arbitrary code remotely.