Attackers exploit critical Ruby on Rails flaw CVE-2026-66066 for remote code execution

August 31, 2026 at 04:24 PM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

Threat actors began exploiting a critical Ruby on Rails vulnerability tracked as CVE-2026-66066 last week, roughly one month after patches were released. The flaw, dubbed KindaRails2Shell, allows unauthenticated remote code execution and lateral movement. VulnCheck warns that even patched servers remain vulnerable to the RCE gadget given a valid signature.

Key Facts

CVE-2026-66066 has a CVSS score of 9.5 and is referred to as KindaRails2Shell.
Ruby on Rails released patches for the flaw in late July 2026.
VulnCheck identified around 7,000 exposed Ruby on Rails instances vulnerable to KindaRails2Shell in early August.
VulnCheck's tests on a patched 8.1.3.1 server showed the RCE gadget still executes given a valid signature.

Vulnerability Mechanics

The flaw is rooted in the different methods used by different libraries and functions to read arbitrary files. Rails may rely on the client-supplied content type to interpret a blob as an image, while libvips looks at the magic bytes to determine the file type. An attacker can craft a file and declare it as MATLAB Level 5, leading libvips to select the MATLAB loader. The file is then routed to libmatio, which identifies MAT 7.3 in a header field and hands it to HDF5. HDF5's External File List lets a dataset's bytes live in another file named by path and offset, so rendering the 'image' reads an attacker-chosen file off the server and returns its contents as pixels.

Exploitation and Impact

An unauthenticated attacker could target anything that the Rails process can read, including the credential database and storage keys. Armed with the compromised secrets, the attacker could forge sessions, access additional systems, and execute arbitrary code remotely. VulnCheck says threat actors started exploiting CVE-2026-66066 last week, roughly one month after patches were released. VulnCheck's tests on a patched 8.1.3.1 server revealed that while the fix blocks the libvips file read, it does not neutralize the variation-key Marshal deserialization. The RCE gadget still executes on a patched server given a valid signature.