{"slug": "langflow-and-rails-are-being-actively-exploited-your-ai-api-keys-are-the-target", "title": "Langflow and Rails Are Being Actively Exploited — Your AI API Keys Are the Target", "summary": "Two critical vulnerabilities are being actively exploited to steal AI API keys and cloud credentials: CVE-2026-0768 in Langflow 1.4.2 and earlier (CVSS 9.8, no authentication required) and CVE-2026-66066 in Ruby on Rails' Active Storage (CVSS 9.5). VulnCheck recorded over 50 detections of Langflow exploitation within hours of August 30, rising to 360 by September 1, with no public proof-of-concept, indicating private exploits. The Rails flaw affects 7,100+ internet-facing instances, and patches exist only for Rails 7.2.3.2, 8.0.5.1, and 8.1.3.1 with libvips 8.13 or later, leaving older versions without upstream fixes.", "body_md": "Two critical vulnerabilities are being actively exploited right now. One is in Langflow — the popular low-code platform for building AI agents and workflows. The other is in Ruby on Rails’ Active Storage image processing pipeline. Attackers are not deploying ransomware. They are not enrolling servers into botnets. They are specifically hunting your `OPENAI_API_KEY`\n\n, your AWS credentials, and your Rails signing secrets. In some cases, they had private exploits before any public proof-of-concept existed.\n\n## Langflow: CVSS 9.8, No Authentication Required\n\nCVE-2026-0768 affects Langflow 1.4.2 and earlier. The flaw lives in the `validate`\n\nendpoint, which Langflow uses for its custom component editor. The endpoint accepts a `code`\n\nparameter and executes it as Python — with no authentication check. An attacker sends a POST request, arbitrary Python runs as root, and the server is theirs.\n\nVulnCheck recorded over 50 detections within hours of August 30, rising to 360 by September 1 — with no public proof-of-concept in circulation. That means a private exploit is in use. The credential harvest follows a predictable script: query `OPENAI_API_KEY`\n\n, `AWS_ACCESS_KEY_ID`\n\n, `AWS_SECRET_ACCESS_KEY`\n\n, read `/root/.cache/langflow/secret_key`\n\n, pull `~/.ssh`\n\n, scan `.bash_history`\n\n, exfiltrate. Lateral movement via SSH follows if the harvest yields usable keys.\n\nThis is not Langflow’s first security failure. CVE-2025-3248 seeded cryptomining botnets. CVE-2026-0769 racked up 15,000+ successful exploitation attempts. CVE-2026-5027 deployed credential harvesters. JFrog’s security team previously found that Langflow’s “fixed” version for CVE-2026-33017 was [still exploitable after patching](https://research.jfrog.com/post/langflow-latest-version-was-not-fixed/). The pattern is clear: Langflow ships fast and patches poorly. If you are running an internet-facing Langflow instance with OpenAI or AWS keys in the environment, you should assume that window is closing.\n\n## Ruby on Rails: Image Upload to Full Server Compromise\n\nCVE-2026-66066, nicknamed KindaRails2Shell, carries a CVSS score of 9.5. The attack is more surgical than the Langflow one. An attacker uploads a crafted image to any Rails application using Active Storage with libvips for image processing. When Rails generates a variant — a thumbnail, a resized version, anything — libvips processes the file through “unfuzzed” loaders that were never hardened against malicious input. The result is arbitrary file read on the server.\n\nFile read becomes full compromise through credential theft. The attacker reads `secret_key_base`\n\nfrom the process environment or config files, which allows forging valid Rails session cookies. From there, cookie deserialization chains become available, and the path to remote code execution is straightforward. The stolen secrets — `RAILS_MASTER_KEY`\n\n, database credentials, S3/GCS/Azure storage keys, API tokens — remain valid even after you patch. [HeroDevs’ analysis](https://www.herodevs.com/blog-posts/cve-2026-66066-rails-active-storage-arbitrary-file-read-and-rce) is unambiguous: patching is necessary but not sufficient.\n\nRails 7.0 made `config.active_storage.variant_processor = :vips`\n\nthe default, which explains why the exposure surface is so wide. [VulnCheck counted 7,100+ internet-facing Rails instances](https://thehackernews.com/2026/09/attackers-exploit-critical-langflow-and.html) as of August. The patch exists — Rails 7.2.3.2, 8.0.5.1, and 8.1.3.1 — but there is a catch: the fix only works if libvips 8.13 or later is installed. Many production environments run older system libvips that will not receive this version through standard package repos without manual intervention. Rails 7.1, 7.0, and 6.x receive no upstream fix at all.\n\n## Why AI Keys Are the Prize\n\nThis is not incidental. Attackers are querying `OPENAI_API*`\n\n, `AWS_ACCESS*`\n\n, and `AWS_SECRET*`\n\nby name — not dumping all environment variables indiscriminately. OpenAI API keys can rack up thousands of dollars in inference charges before the victim notices and revokes them. AWS credentials open a path into the full cloud environment. AI platform operators are running environments loaded with high-value API credentials and doing it with less security discipline than the banking sector.\n\nLangflow in particular is popular with developers who prototype AI agents quickly. Fast prototypes become production deployments without the security review those environments warrant. The result is internet-facing Langflow instances with root-accessible Python execution and OpenAI keys sitting in environment variables. That is a very attractive combination for an attacker running a private exploit.\n\n## What to Do Right Now\n\nFor Langflow: update past 1.4.2 immediately. If your Langflow admin interface is reachable from the internet, put it behind a VPN or auth proxy today — before the update is applied. Given Langflow’s history of incomplete patches, treat the update as a temporary measure and rotate every credential in that environment regardless.\n\nFor Rails: upgrade to 7.2.3.2, 8.0.5.1, or 8.1.3.1 and confirm your system libvips is 8.13 or later. Run `bundle update rails --conservative`\n\nto limit collateral updates. Update ruby-vips to 2.2.1+ if you use it directly. If you cannot upgrade immediately, set `VIPS_BLOCK_UNTRUSTED=1`\n\nas an environment variable — this blocks the exploit on libvips 8.13+ systems. For Rails 7.1 and older, there is no upstream patch. [The full patch release notes cover the specifics.](https://www.linuxcompatible.org/story/rails-7232-8051-and-8131-active-storage-security-patch-targets-cve202666066/)\n\nIn both cases: rotate `secret_key_base`\n\n, master key, all S3/GCS/Azure keys, database credentials, and every API token the application process could read. Patching without rotation leaves any already-stolen credentials valid indefinitely. Check server logs for POST requests to Langflow’s `/api/v1/validate`\n\nendpoint, unusual environment variable queries, and outbound connections to unexpected destinations. The 360-detection count is from canary systems alone. The real exploitation surface is substantially larger.\n\n### Immediate Action Checklist\n\n**Langflow:** Update to latest version (past 1.4.2), restrict admin interface to VPN/auth proxy**Rails:** Patch to 7.2.3.2, 8.0.5.1, or 8.1.3.1 — verify libvips 8.13+ is installed**Temporary Rails mitigation:** Set`VIPS_BLOCK_UNTRUSTED=1`\n\nif immediate upgrade is not possible**Rotate all credentials:**`secret_key_base`\n\n, master key, database passwords, S3/GCS/Azure keys, all API tokens**Audit logs:** Look for POST to`/api/v1/validate`\n\n, env var reads, unexpected outbound connections**Rails 7.1 and older:** No upstream patch — implement alternative mitigation or backport", "url": "https://wpnews.pro/news/langflow-and-rails-are-being-actively-exploited-your-ai-api-keys-are-the-target", "canonical_source": "https://byteiota.com/langflow-and-rails-are-being-actively-exploited-your-ai-api-keys-are-the-target/", "published_at": "2026-09-02 18:13:14+00:00", "updated_at": "2026-09-02 18:24:52.221569+00:00", "lang": "en", "topics": ["ai-safety", "ai-infrastructure"], "entities": ["Langflow", "Ruby on Rails", "Active Storage", "VulnCheck", "HeroDevs", "JFrog", "OpenAI", "AWS"], "alternates": {"html": "https://wpnews.pro/news/langflow-and-rails-are-being-actively-exploited-your-ai-api-keys-are-the-target", "markdown": "https://wpnews.pro/news/langflow-and-rails-are-being-actively-exploited-your-ai-api-keys-are-the-target.md", "text": "https://wpnews.pro/news/langflow-and-rails-are-being-actively-exploited-your-ai-api-keys-are-the-target.txt", "jsonld": "https://wpnews.pro/news/langflow-and-rails-are-being-actively-exploited-your-ai-api-keys-are-the-target.jsonld"}}