Critical Langflow and Rails Flaws Actively Exploited by Attackers
Threat actors are leveraging high-severity vulnerabilities in Langflow and Ruby on Rails to conduct credential probing and establish command-and-control infrastructure. These exploits enable remote code execution and unauthorized access.
TL;DR
- Attackers are actively exploiting two critical vulnerabilities: CVE-2026-0768 in Langflow and CVE-2026-66066 in Ruby on Rails.
- CVE-2026-0768 allows unauthenticated remote code execution with root privileges due to improper input validation.
- CVE-2026-66066 impacts Rails applications and can lead to similar severe outcomes if left unpatched.
- Observed malicious activities include credential probing and C2 communication.
- Organizations using affected versions should apply patches immediately and monitor for suspicious activity.
Security researchers at VulnCheck have identified active exploitation of two critical vulnerabilities affecting widely-used development tools: Langflow and Ruby on Rails. These flaws are being leveraged by threat actors to gain unauthorized access, probe for credentials, and potentially establish persistent backdoors.
The more severe of the two, CVE-2026-0768, impacts Langflow and allows unauthenticated attackers to execute arbitrary Python code with root-level privileges. This vulnerability stems from inadequate validation of user-supplied inputs. Concurrently, CVE-2026-66066 affects Ruby on Rails applications and presents a similarly high risk to exposed systems.
With both vulnerabilities now confirmed as under active exploitation, organizations relying on these technologies must prioritize immediate remediation efforts to prevent compromise.
Vulnerability Details
- CVE-2026-0768 has a CVSS score of 9.8, indicating critical severity. It enables remote code execution without authentication.
- The flaw exists in Langflow due to missing input sanitization, allowing attackers to run arbitrary commands as root.
- CVE-2026-66066 affects Ruby on Rails applications and poses risks including data theft and server takeover.
- Both vulnerabilities are remotely exploitable and do not require prior access or user interaction.
Observed Attack Patterns
- Threat actors are scanning public-facing services for vulnerable instances of Langflow and Rails.
- Initial access is followed by credential probing attempts to escalate privileges or move laterally.
- Command-and-control (C2) infrastructure setup has been observed post-exploitation.
- Indicators suggest automated tooling is being used to scale attacks across multiple targets.
- No specific threat group has been conclusively attributed, but tactics align with known cybercrime operations.
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.