Remote Code Execution in Langflow and Rails Active Storage: CVE Analysis

Two critical vulnerabilities — CVE-2026-0768 in the AI application development platform Langflow and CVE-2026-66066 (KindaRails2Shell) in the Active Storage component of the Ruby on Rails framework — pose a serious threat to organizations that use these technologies. Both vulnerabilities allow an unauthenticated attacker to achieve remote code execution and gain access to highly sensitive secrets: encryption keys, database credentials, cloud storage credentials, and API tokens. VulnCheck reports observing activity aimed at exploiting these vulnerabilities. Administrators of affected systems must immediately apply updates and rotate all secrets.

Technical analysis of the vulnerabilities

CVE-2026-0768 — arbitrary code execution in Langflow

CVE-2026-0768 (CVSS 9.8, critical) is a code injection vulnerability in a Langflow validation endpoint. The lack of proper user input validation allows a remote unauthenticated attacker to send a specially crafted code parameter and execute arbitrary Python code in the context of the process running with root privileges. According to the entry in the GitHub Advisory Database, the affected and fixed versions have not yet been specified in the advisory.

This vulnerability adds to a series of previously identified critical issues in Langflow:

• CVE-2025-3248 (CVSS 9.8) — unauthenticated remote code execution via the /api/v1/validate/code endpoint, affecting versions prior to 1.3.0. Details are available in the official Langflow advisory.
• CVE-2026-0769 (CVSS 9.8) — injection via eval_custom_component_code, affecting at least Langflow 1.3.2, according to the NVD entry.
• CVE-2026-33309 (CVSS 9.9) — arbitrary file write via /api/v2/files due to lack of filename sanitization in multipart requests. Affects Langflow versions 1.2.0–1.8.1 and is fixed in version 1.9.0. Described in the Langflow advisory on GitHub.

Important clarification: in the original VulnCheck material, the arbitrary file write vulnerability is referenced under the identifier CVE-2026-5027, whereas the official Langflow advisory assigns this issue the identifier CVE-2026-33309. This discrepancy should be taken into account when searching for information and applying patches.

CVE-2026-66066 (KindaRails2Shell) — file read and RCE in Rails Active Storage

CVE-2026-66066 (CVSS v4 9.5, critical) affects the Active Storage component of the Ruby on Rails framework when using the libvips library for image processing. The vulnerability is exploited by uploading a specially crafted image: the attacker leverages a discrepancy between how Active Storage and libvips interpret input files. This allows a remote unauthenticated attacker to read arbitrary files from the server.

According to the official Rails advisory, successful exploitation may expose:

• secret_key_base and the Rails master key
• Encrypted application credentials
• Database passwords
• Cloud storage credentials
• Third-party service API tokens

The official advisory describes the possibility of escalation to remote code execution, but emphasizes that RCE is not a guaranteed outcome for every deployment — this depends on the configuration of the specific application.

Affected Active Storage versions:

• All versions below 7.2.3.2
• Versions from 8.0.0.beta1 to 8.0.5 (excluding 8.0.5.1)
• Versions from 8.1.0.beta1 to 8.1.3 (excluding 8.1.3.1)

Exploitation prerequisites: the application must use the :vips processor for image variant processing in Active Storage and accept image uploads from untrusted users.

Threat context and scale of the issue

AI application development platforms such as Langflow are becoming an attractive target for attackers. These systems often store access keys to cloud services, language model API tokens, and credentials for connecting to databases. Compromise of a single Langflow instance can give an attacker access to a wide range of associated systems and services.

The presence of four critical vulnerabilities in Langflow (CVE-2026-0768, CVE-2025-3248, CVE-2026-0769, CVE-2026-33309) over a relatively short period points to systemic issues with user input validation security in this platform. Each of these vulnerabilities has a CVSS score above 9.0 and allows remote code execution.

As for CVE-2026-66066, according to VulnCheck, more than 7,100 vulnerable Ruby on Rails instances with open internet access had been identified by early August. Given the widespread use of Rails in web development, the actual number of affected applications may be significantly higher, since many of them sit behind load balancers and are not detected by external scanning. It should be noted that these statistics are provided by VulnCheck and have not been independently confirmed by other sources.

Practical recommendations

For Ruby on Rails users

1. Immediately update Active Storage to one of the fixed versions: 7.2.3.2, 8.0.5.1, or 8.1.3.1.
2. Update libvips to version 8.13 or newer — this is an additional recommendation from the official Rails advisory.
3. Rotate all secrets after updating: secret_key_base, the Rails master key, database passwords, cloud storage credentials, and API tokens. The patch does not undo any data leakage that may have occurred prior to updating.
4. Use the forensic analysis tools published by the Rails team to check for signs of exploitation.
5. If immediate updating is not possible, consider temporarily disabling image variant processing via libvips or blocking image uploads from unauthenticated users.

For Langflow users

1. Update Langflow to version 1.9.0 or newer to address CVE-2026-33309.
2. Ensure you are running at least version 1.3.0 to protect against CVE-2025-3248.
3. Check for updates that remediate CVE-2026-0768 and CVE-2026-0769.
4. Do not expose Langflow directly to the internet without authentication and network segmentation.
5. Audit environment variables and secrets accessible to the Langflow process: OpenAI keys, AWS keys, SSH access, and similar credentials.

The combination of critical vulnerabilities in Langflow and Rails Active Storage requires priority response. For Rails applications, it is crucial not only to install the patch but also to perform a full rotation of secrets — the official Rails advisory explicitly points this out, since updating does not eliminate the consequences of any data leakage that has already occurred. For Langflow, the key measures are to eliminate direct internet exposure and update to current versions that close all four known remote code execution vulnerabilities.