~/f4n6 $ grep -r "KindaRails2Shell threatens Ruby on Rails apps (CVE-2026-66066)" ./investigations/ --include="*.md"

KindaRails2Shell threatens Ruby on Rails apps (CVE-2026-66066)

Jeff Davies 03 Aug 2026 6 min read

1. Executive summary

CVE-2026-66066 (CVSS 9.5 CRITICAL, EPSS 2%, not in CISA KEV) is an insecure default initialization vulnerability (CWE-1188) in Ruby on Rails Active Storage when used with the libvips image processor. An unauthenticated attacker can exploit the flaw — dubbed "KindaRails2Shell" — by uploading a crafted image file that triggers unsafe libvips operations, enabling arbitrary file read from the server including process environment secrets such as secret_key_base, database passwords, and cloud storage credentials. Exposure of these secrets can escalate to remote code execution or lateral movement to connected systems. EMEA financial services running Rails 7.x or 8.x with default Vips configuration and user-facing image upload features are directly impacted; no exploitation in the wild has been confirmed as of 30 July 2026.

2. Regulatory framing

Article Trigger (the fact in this item) Practical impact
DORA Art. 24: digital operational resilience testing — general requirements The vulnerability resides in a default framework configuration (Vips as default since Rails 7.0), meaning standard build/deploy pipelines would inherit the insecure default without specific testing of image-processing pathways. Clients must include image-upload/processing pathways in resilience testing programmes; verify that Active Storage variant processing does not invoke untrusted libvips operations.
DORA Art. 19: reporting of major ICT-related incidents to competent authorities If exploited, arbitrary file read of secret_key_base and credentials constitutes potential compromise of authentication integrity and connected system access — likely meeting major incident classification thresholds. Clients must have pre-built classification playbooks for this CVE so that confirmation of exploitation triggers authority notification within DORA timelines.

3. Technical analysis & attack chain

Affected versions

  • Rails 7.0.0 through 7.2.3.1 (Vips is the default variant processor from Rails 7.0+)
  • Rails 8.0.0 through 8.0.5
  • Rails 8.1.0 through 8.1.3
  • Rails 6.0.0 through 6.1.7.10 — affected ONLY if Active Storage is manually configured to use Vips (not default for 6.x); no fix available for 6.x branch

Not affected: Applications using ImageMagick (Magick) processor instead of Vips.

Vulnerability mechanism

libvips supports loading numerous file formats beyond standard images, including MATLAB .mat files, NIfTI medical scans, SVG, and PDF files. Some of these format loaders are marked "unfuzzed" or "untrusted" because they are unsafe for processing untrusted content. Active Storage did not disable these untrusted operations before processing user-supplied files. A crafted upload can trigger an unsafe operation and cause libvips to read and disclose files accessible to the Rails application process.

Attack chain (confirmed steps)

  1. Attacker uploads a crafted file through any user-facing image upload feature (avatars, thumbnails, profile pictures, direct uploads).
  2. Active Storage passes the file to libvips for variant processing (resizing/thumbnail generation). Generating variants is not a separate requirement for exposure — the processing path itself is sufficient.
  3. The crafted file triggers an untrusted libvips operation that reads arbitrary files from the server filesystem.
  4. The Rails process environment is exposed, including secret_key_base, the Rails master key, database passwords, cloud storage credentials (S3, GCS, Azure), and third-party service tokens/keys.
  5. Exposed secrets may enable escalation to remote code execution (e.g., via secret_key_base manipulation of signed/encrypted cookies, signed global IDs, or Active Storage URLs) or lateral movement to connected external systems using stolen credentials.

Key details

  • No authentication is required to exploit this vulnerability.
  • The vulnerability exists in the default configuration of Rails 7.0+; no non-standard setup is needed for exposure.
  • Multiple third-party projects and software built on Ruby on Rails may also be affected.
  • Public proof-of-concept code exists but its correspondence to the full privately-reported attack chain is unclear. Ethiack and GMO Flatt Security have withheld full PoC details; additional disclosure expected no later than 28 August 2026.

Confidence caveat: The full attack chain details are single-sourced to the Rails security advisory and Ethiack's reporting; Rapid7 corroborates the vulnerability mechanism and affected versions but notes the complete exploitation path has not been publicly verified. ANSSI (CERT-FR) independently confirms arbitrary code execution and data confidentiality impact.

4. Mitigation & containment

P1 — Within 24 hours

  1. Identify exposure: Inventory all Rails applications. Check whether Active Storage is configured with Vips (default for Rails 7.0+) and whether any feature accepts user-uploaded images. Applications using ImageMagick are not affected.
  2. Apply temporary workaround (if patching cannot be immediate): On systems with libvips ≥ 8.13, set the environment variable VIPS_BLOCK_UNTRUSTED to disable untrusted operations during Active Storage initialization. Alternatively, with ruby-vips ≥ 2.2.1, call Vips.block_untrusted(true) from an initializer.
  3. For libvips < 8.13: No workaround is available other than removing the dependency on libvips from the application. Prioritise upgrading libvips or switching to ImageMagick.

P2 — Within 72 hours

  1. Upgrade Rails to a fixed release: - Rails 7.x → 7.2.3.2 (Active Storage 7.2.3.2) - Rails 8.0.x → 8.0.5.1 (Active Storage 8.0.5.1) - Rails 8.1.x → 8.1.3.1 (Active Storage 8.1.3.1)
  2. Upgrade libvips to 8.13 or later. Updating Rails or Active Storage alone is NOT sufficient if an older libvips version remains installed. When ruby-vips is installed, ensure it is version 2.2.1 or later. Patched versions will refuse to start if ruby-vips or libvips is too old to support the protection.
  3. Rails 6.x applications: No fixed release is available. Migrate to a supported fixed branch (7.2.3.2, 8.0.5.1, or 8.1.3.1) or apply the workaround above if libvips ≥ 8.13 is present.

P3 — Within 7 days

  1. Rotate all secrets accessible to the application process: - secret_key_base (rotation expires active sessions; affects encrypted/signed cookies, signed global IDs, and Active Storage URLs) - Rails master key and all credentials it decrypts - Database credentials - Cloud storage service credentials (S3, GCS, Azure) - Third-party service tokens and API keys
  2. Review application logs for anomalous image upload activity, particularly uploads of non-standard file formats (.mat, .nii, SVG, PDF) through image upload endpoints.
  3. Deploy WAF rules if available — Akamai has coordinated with Ethiack and deployed WAF rules targeting the KindaRails2Shell attack pattern.

5. Indicators of compromise

No indicators of compromise available in the source material.

Behavioural indicators

Behaviour Where to observe Confidence
Upload of non-image file formats (.mat, .nii, SVG, PDF) through image upload endpoints Web application access logs; Active Storage upload logs Medium — derived from vulnerability mechanism, not observed exploitation
Anomalous variant processing errors or libvips operation failures on user-uploaded files Application error logs; libvips processing logs Medium — expected artefact of crafted file processing
Unexpected access to environment files or /proc/self/environ by the Rails process OS-level file access auditing; EDR process file-read telemetry Low — inferred from vulnerability capability, not observed

6. Detection

Insufficient indicators to author detection rules.

CVE assessment

1 referenced CVE — 1 critical (CVSS ≥ 9.0)

CVE CVSS Exploited EPSS Summary
CVE-2026-66066 9.5 Critical — 2% Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Acti…

7. Sources

  • Help Net Security — "KindaRails2Shell threatens Ruby on Rails apps (CVE-2026-66066)" — https://www.helpnetsecurity.com/2026/08/03/kindarails2shell-cve-2026-66066-vulnerability/ — 2026-08-03
  • The Hacker News — "Critical Rails Flaw Could Let Unauthenticated Attackers Read Server Files via Image Uploads" — https://thehackernews.com/2026/07/critical-rails-flaw-could-let.html — 2026-07
  • Rapid7 Blog — "KindaRails2Shell: CVE-2026-66066, Critical Arbitrary File Read and Possible Remote Code Execution in Ruby on Rails" — https://www.rapid7.com/blog/post/etr-kindarails2shell-cve-2026-66066-critical-arbitrary-file-read-and-possible-remote-code-execution-in-ruby-on-rails — 2026-07
  • ANSSI France CERT — "Vulnérabilité dans Ruby on Rails activestorage" — https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0948/ — 2026-07-30
  • ANSSI France CERT — "Vulnérabilité dans Ruby on Rails" — https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0891/ — 2026-07-16

8. Adverse Trace position

CVE-2026-66066 is a CRITICAL-severity vulnerability (CVSS 9.5) with a low EPSS score (2%) and no confirmed exploitation in the wild as of 30 July 2026. Despite the low EPSS, the severity of impact — unauthenticated arbitrary file read leading to potential RCE via secret exposure — justifies urgent remediation outside normal patch cycles, particularly for EMEA financial services where Rails applications commonly handle customer-facing image uploads (KYC document scans, profile photos, etc.). The vulnerability affects default configurations, meaning exposure is likely broader than clients realise. The existence of public PoC code (unverified against the full chain) and the scheduled disclosure of additional details by 28 August 2026 increases the likelihood of exploitation in the near term. We are monitoring for emergence of exploitation evidence and will update this advisory if CISA KEV status changes or IOCs become available. Clients should treat this as a P1 remediation and ensure secret rotation is completed post-patch, as patching alone does not remediate prior secret exposure.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.

Post this to LinkedIn
Formatting is converted automatically — headings, bullets, a link back & hashtags. Paste straight in.
J
Jeff Davies