Critical Vulnerabilities in Langflow and Ruby on Rails Under Active Exploitation
Security researchers at VulnCheck have detected active exploitation of two critical vulnerabilities CVE-2026-0768 in Langflow and CVE-2026-66066 in Ruby on Rails with attackers rapidly moving from reconnaissance to credential harvesting and potential remote code execution (RCE).
Langflow RCE (CVE-2026-0768)
The flaw, an unauthenticated RCE vulnerability in Langflow’s custom component editor, was disclosed via Trend Micro’s Zero Day Initiative in January 2026. Despite the lack of a public proof-of-concept exploit, VulnCheck observed over 360 exploitation attempts targeting its internet-facing Canary systems shortly after the vulnerability was added to its Known Exploited Vulnerabilities (KEV) catalog.
Attackers primarily sought environment variables linked to Langflow administration, OpenAI APIs, and AWS cloud access. Additional malicious activity included:
- Reading Langflow’s secret_key file at
/root/.cache/langflow/secret_key - Inspecting SSH access and
.bash_historyfiles to identify admin activity and lateral movement paths - Traffic originating primarily from Russia, targeting systems in the UK
This follows a broader trend of Langflow vulnerabilities being added to VulnCheck’s KEV catalog in 2026.
Ruby on Rails File-Read-to-RCE (CVE-2026-66066)
Separately, attackers exploited CVE-2026-66066, a critical Active Storage file-read-to-RCE flaw in Ruby on Rails. Exploitation attempts were detected on Canary systems in Singapore, Israel, and the UK, with activity traced to a single source IP in France and command-and-control (C2) communication linked to a host in Israel.
The vulnerability allows attackers to read sensitive files, including:
secret_key_base- API tokens
- Database credentials
- Cloud storage keys
Even after patching, compromised secrets such as secret_key_base can enable session forgery and further abuse until rotated.
Impact & Attacker Behavior
Both vulnerabilities highlight the growing targeting of AI application platforms and web frameworks. Attackers prioritized credential harvesting over immediate destructive payloads, suggesting a focus on long-term access and lateral movement.
Organizations running affected software are advised to patch immediately, restrict public access to admin interfaces, and review logs for suspicious activity particularly commands targeting environment variables, secret files, SSH directories, or shell history. Credential rotation is critical if exploitation is suspected.
Source: https://cybersecuritynews.com/langflow-rce-and-rails-vulnerability-exploited/
Ruby on Rails - The Rails Foundation cybersecurity rating report: https://www.rankiteo.com/company/ruby-on-rails-org
Langflow cybersecurity rating report: https://www.rankiteo.com/company/langflow
"id": "RUBLAN1788272691",
"linkid": "ruby-on-rails-org, langflow",
"type": "Vulnerability",
"date": "1/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'industry': 'Technology',
'name': 'Langflow',
'type': 'AI Application Platform'},
{'industry': 'Technology',
'name': 'Ruby on Rails',
'type': 'Web Framework'}],
'attack_vector': ['Unauthenticated RCE', 'File-Read-to-RCE'],
'data_breach': {'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Environment variables',
'Secret_key',
'API tokens',
'Database credentials',
'Cloud storage keys',
'SSH access',
'.bash_history']},
'date_publicly_disclosed': '2026-01',
'description': 'Security researchers at VulnCheck detected active '
'exploitation of two critical vulnerabilities CVE-2026-0768 in '
'Langflow and CVE-2026-66066 in Ruby on Rails. Attackers '
'rapidly moved from reconnaissance to credential harvesting '
'and potential remote code execution (RCE).',
'impact': {'data_compromised': ['Environment variables',
'Secret_key',
'API tokens',
'Database credentials',
'Cloud storage keys',
'SSH access',
'.bash_history'],
'systems_affected': ['Langflow', 'Ruby on Rails']},
'lessons_learned': 'Organizations should prioritize patching critical '
'vulnerabilities, restrict public access to admin '
'interfaces, and rotate credentials if exploitation is '
'suspected.',
'motivation': ['Credential Harvesting',
'Long-term Access',
'Lateral Movement'],
'post_incident_analysis': {'corrective_actions': ['Patch management',
'Credential rotation',
'Restrict admin interface '
'access'],
'root_causes': ['Unauthenticated RCE in Langflow',
'File-Read-to-RCE in Ruby on '
'Rails']},
'recommendations': ['Patch immediately',
'Restrict public access to admin interfaces',
'Review logs for suspicious activity',
'Rotate credentials if exploitation is suspected'],
'references': [{'source': 'VulnCheck'},
{'source': 'Trend Micro’s Zero Day Initiative'}],
'response': {'recovery_measures': ['Credential rotation'],
'remediation_measures': ['Patch immediately',
'Restrict public access to admin '
'interfaces',
'Review logs for suspicious activity']},
'title': 'Critical Vulnerabilities in Langflow and Ruby on Rails Under Active '
'Exploitation',
'type': ['Remote Code Execution (RCE)', 'Credential Harvesting'],
'vulnerability_exploited': ['CVE-2026-0768', 'CVE-2026-66066']}