Critical Ruby on Rails Vulnerability, KindaRails2Shell, Actively Exploited
A critical arbitrary file read vulnerability in Ruby on Rails, dubbed KindaRails2Shell and tracked as CVE-2026-66066, is being actively exploited by attackers to steal secrets and achieve remote code execution.
A critical vulnerability affecting Ruby on Rails, identified as CVE-2026-66066 and nicknamed KindaRails2Shell, is now being actively exploited by threat actors. This flaw, with a CVSS score of 9.5, allows for arbitrary file reads, leading to the exposure of sensitive secrets, remote code execution (RCE), and subsequent lateral movement within compromised networks.
The vulnerability was initially disclosed in late July, prompting Ruby on Rails to release patches. Developers were urged to immediately update all Rails applications that utilize libvips for Active Storage image processing and accept image uploads from untrusted sources. Following the patch release, security researchers quickly reverse-engineered the bug, publishing technical details and proof-of-concept (PoC) code. Rails also provided forensic tools to aid in detecting exploitation attempts.
The root cause of KindaRails2Shell lies in the differing methods employed by various libraries and functions for reading arbitrary files. While the Rails framework might rely on a client-supplied content type to interpret a file as an image, the underlying libvips library inspects the file's "magic bytes" to determine its true type. This discrepancy allows an attacker to craft a malicious file, falsely declare it as a MATLAB Level 5 file, which then causes libvips to invoke the MATLAB loader.
This loader, in turn, routes the file to libmatio, which identifies a MAT 7.3 header. The HDF5 library then processes this, leveraging its "External File List" feature. This feature permits a dataset's bytes to reside in a separate file, specified by path and offset. Consequently, when rendering the "image," the system reads an attacker-chosen file from the server and returns its contents, effectively disguised as image pixels. This complex interaction, involving two layers that cannot directly observe each other's interpretations, creates the vulnerability.
An unauthenticated attacker exploiting this flaw can target any file accessible by the Rails process. This includes highly sensitive data such as credential databases and storage keys. With these compromised secrets, attackers can forge user sessions, gain access to additional systems, and ultimately execute arbitrary code remotely on the affected servers.
According to VulnCheck, threat actors began actively exploiting CVE-2026-66066 approximately one month after the patches were made available. Worryingly, VulnCheck's analysis of a patched server (version 8.1.3.1) revealed that while the libvips file read vulnerability was mitigated, the RCE gadget remained effective due to an unaddressed variation-key Marshal deserialization vulnerability. This means that even on patched systems, a valid signature could still lead to RCE.
In early August, VulnCheck observed approximately 7,000 Ruby on Rails instances exposed and vulnerable to KindaRails2Shell. The active exploitation underscores the urgency for all users of affected Ruby on Rails versions to apply the necessary patches and verify their systems for any signs of compromise. The ongoing exploitation of this vulnerability highlights the persistent threat posed by complex, multi-layered flaws in widely used software frameworks.