8 mincritical
CVE-2026-66066: Defending Against the “KindaRails2Shell” Pre-Auth RCE | Akamai
CVE-2026-66066 is a critical (CVSS 9.5) pre-auth remote code execution vulnerability in Ruby on Rails Active Storage, which uses libvips as its default image processor since Rails 7.0. An unauthenticated attacker can upload a specially crafted image that triggers unsafe libvips operations, enabling arbitrary file reads — most critically the application's secretkeybase and other environment secrets. With the secretkeybase compromised, the attacker can forge session cookies and achieve full RCE on the server. Immediate patching of Rails and libvips, along with rotation of all application secrets, is required.
Sens:■ Immediate
Detection / Hunteropenrouter
What Happened
A serious security flaw has been found in Ruby on Rails, a popular web application framework. The problem is in a component called Active Storage, which handles image uploads and processing. An attacker who exploits this flaw does not need a username or password — they simply upload a specially crafted image file to a vulnerable website. This lets them read sensitive files from the server, including the application's master cryptographic key. With that key, the attacker can impersonate legitimate users and take full control of the server. Any organization running a vulnerable version of Rails that accepts image uploads from the public is at risk. Administrators should immediately update Rails and its image processing library, and also change all passwords and secret keys stored on the server, since these may already have been stolen.
Key Takeaways
- CVE-2026-66066 is a critical (CVSS 9.5) pre-auth arbitrary file read and RCE vulnerability in Ruby on Rails Active Storage component when processing images via libvips.
- An unauthenticated attacker can upload a crafted image to trigger unsafe libvips operations, read arbitrary files including the secret_key_base, and escalate to full RCE via forged session cookies.
- Affected versions: Rails Active Storage prior to 7.2.3.2, 8.0.x prior to 8.0.5.1, and 8.1.x prior to 8.1.3.1.
- Patching alone is insufficient if compromise already occurred — all application secrets (secret_key_base, DB passwords, API tokens) must be rotated.
- Akamai deployed Rapid Rule 3000989 v1 for targeted detection of this exploit in App & API Protector.
Affected Systems
- Ruby on Rails applications using Active Storage with libvips (default since Rails 7.0)
- Rails Active Storage versions prior to 7.2.3.2
- Rails Active Storage 8.0.x versions prior to 8.0.5.1
- Rails Active Storage 8.1.x versions prior to 8.1.3.1
Vulnerabilities (CVEs)
copy:
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-66066 | Ruby on Rails Active Storage (libvips image processor) | Critical | Unauthenticated arbitrary file read via unsafe libvips operations triggered by crafted image uploads, escalating to RCE through exposure of secret_key_base and forged session cookies. |
Attack Chain
- Initial Access: Unauthenticated attacker uploads a specially crafted image file to a web endpoint accepting untrusted user uploads
- Arbitrary File Read: Active Storage triggers libvips to process the image, invoking unsafe operations that allow reading arbitrary files from the server filesystem
- Credential Exposure: Attacker reads the application's environment variables, extracting the secret_key_base, cloud storage credentials, and database passwords
- Privilege Escalation / RCE: Attacker uses the stolen secret_key_base to forge session cookies, sign global IDs, and manipulate serialized data, achieving full remote code execution on the server
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
- Platforms: Akamai App & API Protector Rapid Rule 3000989 v1
Akamai has deployed Rapid Rule 3000989 v1 ('Rails2Shell Exploit Attempt Detected') in App & API Protector for targeted detection of CVE-2026-66066 exploit attempts. Adaptive Security Engine also provides baseline coverage for malicious file uploads and command injection. No open-source detection rules (YARA, Sigma, Snort/Suricata) are provided in the article.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | EDR can potentially detect unusual child processes spawned by the Rails application process if RCE is achieved, but the initial file read and secret extraction may occur entirely within the legitimate Rails/libvips process context, making it harder to distinguish from normal image processing activity. |
| Network Visibility | Medium | The initial malicious upload is visible as an HTTP POST with a crafted image file. WAF rules can detect known exploit patterns. However, the arbitrary file read occurs server-side and may not produce distinctive network traffic unless exfiltration occurs over a separate channel. |
| Detection Difficulty | Moderate | The initial exploit attempt (crafted image upload) can be detected by WAF rules. However, the arbitrary file read and secret_key_base extraction occur within the legitimate libvips processing pipeline, making it difficult to distinguish from normal image variant generation without application-level instrumentation or file access monitoring. |
Required Log Sources
- Web application firewall logs (HTTP request bodies, file upload metadata)
- Application server logs (Rails request logs, Active Storage processing logs)
- EDR process telemetry (child process spawning from web application processes)
- File access audit logs (monitoring reads of environment/config files by web application processes)
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for web application processes (e.g., Ruby/Rails workers) that suddenly spawn unexpected child processes or shell interpreters, which could indicate RCE achieved via forged session cookies after secret_key_base theft. | EDR process creation events, parent-child process relationships | Execution | Medium — legitimate application maintenance scripts or background job workers may spawn child processes from the same parent. |
| Consider hunting for unusual file access patterns where the web application process reads configuration or environment files (e.g., .env files, config/master.key) outside of normal startup or deployment windows. | File access audit logs, EDR file read telemetry | Collection | Medium — Rails processes legitimately read config files during boot; timing and frequency baselines are needed to reduce noise. |
| Consider hunting for HTTP POST requests to image upload endpoints that contain files with unusual MIME type mismatches or files that fail normal image validation but still trigger processing. | WAF logs, reverse proxy logs, application request logs | Initial Access | Low to Medium — legitimate users may occasionally upload corrupted or mislabeled image files. |
| Consider hunting for signs of session cookie forgery — multiple sessions using cookies that pass signature validation but originate from unexpected IP ranges or exhibit unusual user-agent patterns. | Application authentication logs, session management logs, web server access logs | Privilege Escalation | Medium — legitimate users behind VPNs or proxies may show IP variability. |
Control Gaps
- Standard WAF rules without specific CVE-2026-66066 signatures may not detect the crafted image upload pattern.
- File access monitoring for environment/config files is often not enabled on application servers, allowing silent secret extraction.
- Session validation mechanisms cannot detect forged cookies if the secret_key_base itself has been compromised — the forged cookies will pass all cryptographic checks.
Key Behavioral Indicators
- Web application process (Ruby/Rails) spawning unexpected child processes or shell interpreters (T1059 patterns)
- Unusual file read activity by the libvips or Rails worker process targeting environment or configuration files
- Image upload requests with anomalous file sizes, MIME type mismatches, or files that trigger processing errors in Active Storage logs
- Sudden changes in session cookie usage patterns or authentication anomalies following a file upload event
False Positive Assessment
Low — The exploit requires a specific crafted image upload pattern that is unlikely to occur in normal user traffic. WAF rules targeting CVE-2026-66066 should have low false positive rates, though generic malicious upload detection may generate some noise from corrupted or mislabeled legitimate image uploads.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Prioritize patching Rails Active Storage to version 7.2.3.2, 8.0.5.1, or 8.1.3.1 (or later) on all affected systems immediately.
- Consider rotating all application secrets — including secret_key_base, database passwords, and third-party API tokens — on any system running a vulnerable version, even if no compromise is suspected, as file read may have occurred without obvious indicators.
- If your WAF or CDN supports custom rules, consider evaluating whether Akamai Rapid Rule 3000989 v1 or equivalent vendor-specific detection is available and enabled for your protected applications.
- If feasible, consider temporarily restricting unauthenticated image upload endpoints until patches are applied, or implement additional validation on uploaded file types.
Infrastructure Hardening
- Evaluate whether your Rails applications can run with reduced filesystem permissions for the application process, limiting which files libvips can access during image processing.
- Consider isolating image processing into a separate, sandboxed container or worker process with minimal filesystem access and no access to environment secrets.
- Review whether libvips can be configured to disable the unsafe operations referenced in the vulnerability, if your application does not require them.
- Consider implementing network-level segmentation between application servers and secret stores (e.g., secrets managers) to reduce blast radius if the application process is compromised.
User Protection
- Consider enabling additional upload validation layers (file type verification via magic bytes, size limits, and image dimension constraints) at the edge or reverse proxy level.
- If your application supports it, evaluate switching to an alternative image processor that does not expose the unsafe libvips operations, though this requires thorough testing.
Security Awareness
- Consider notifying development teams that simply upgrading Rails is insufficient if compromise has already occurred — secret rotation is mandatory.
- If applicable to your organization, consider adding this vulnerability to your secure deployment checklist for Rails applications that handle user-uploaded images.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping4 techniques
Tactic
Initial Access
Tactic
Credential Access
Tactic
Discovery
Tactic
Lateral Movement
Stay currentSubscribe via RSS
