CVE-2026-66066: Rails Active Storage vulnerability actively exploited; CVSS 9.5 PoC public
Ruby on Rails confirmed CVE-2026-66066 (CVSS 9.5) is exploited in the wild. Attackers chain Active Storage file-read and deserialization bugs for unauthenticated RCE. About 7,000 instances are exposed to the public internet.
CVE-2026-66066 has moved from theoretical risk to live threat: vulnerability-intel firm VulnCheck confirmed on August 31 that this CVSS 9.5 Ruby on Rails chain is being exploited. Under default configuration, attackers can achieve unauthenticated arbitrary file read and ultimately remote code execution. About 7,000 Rails instances are exposed on the public internet.
Incident overview
The chain is known in the security community as KindaRails2Shell. It lives in Rails Active Storage. Root cause is parser confusion among Rails, libvips, libmatio, and HDF5: after the attacker submits a specially crafted file, the server reads an attacker-chosen file as "image pixels," bypassing type checks for arbitrary file read, then chains follow-on bugs to code execution.
Affected versions
- Rails 7.2.0 – 7.2.3.1
- Rails 8.0.0 – 8.0.5
- Rails 8.1.0 – 8.1.3
These versions are affected under default configuration. Official fixed versions are 7.2.3.2, 8.0.5.1, and 8.1.3.1, released in late July.
Technical details
About a month after the fix, with public PoC circulating, VulnCheck observed real exploitation. VulnCheck notes the patch does not fully kill the chain: it blocks the libvips file read but does not remove the variation-key Marshal deserialization issue — given a valid signature, RCE gadgets can still run on patched servers.
If application signing keys leak, upgrading Rails alone does not fully eliminate risk. The vulnerability is not yet on the CISA KEV catalog.
Impact assessment
CVSS 9.5, unauthenticated, default-config exploitable, plus public PoC and confirmed in-the-wild use. Internet-exposed Rails apps are at direct risk. Attackers can first read application keys and config files, then abuse the signing mechanism for deserialization RCE.
Remediation
- Upgrade to Rails 7.2.3.2 / 8.0.5.1 / 8.1.3.1 or later;
- Rotate secret_key_base and other signing keys to shrink abuse of "valid signatures";
- Hunt Active Storage upload logs for anomalous image requests and unusual Content-Type values;
- Add WAF rules on internet-exposed Rails instances to block suspicious Active Storage parse requests.
Sources
- KindaRails2Shell Under Attack (includes VulnCheck intel, 2026-08-31)
- SecurityWeek reporting