Observations have shown that threat actors are actively exploiting critical vulnerabilities in Langflow and Ruby on Rails, with attacks moving beyond vulnerability testing to credential discovery and reconnaissance, according to threat intelligence firm VulnCheck.
The CVE-2026-0768 vulnerability, which has a CVSS score of 9.8, affects Langflow, a low-code platform used to develop artificial intelligence applications.
It is a vulnerability in which user-controlled input is not adequately validated and can allow attackers to execute arbitrary Python code with root privileges on vulnerable systems.
Trend Micro's Zero Day Initiative initially disclosed this vulnerability in January 2026. CVE-2026-66066, also known as KindaRails2Shell, affects Ruby on Rails and has a CVSS score of 9.5.
This flaw can be exploited by unauthenticated attackers to gain access to arbitrary files, to expose data regarding Rails processes, and to retrieve sensitive information, including secrets_key_base, Rails master key, database credentials, cloud storage credentials and API tokens. Such access can ultimately lead to remote code execution.
Exploitation of CVE-2026-66066 is facilitated by a parsing inconsistency between Rails Active Storage and the libvips image processing library.
Attackers can submit specially crafted images to applications that utilize libvips for Active Storage processing and accept uploads from untrusted users in order to exploit the vulnerability Successful exploitation depends on the vulnerable configuration of the affected application.
During the first few hours on August 30, VulnCheck reported more than 50 detections, but the number increased to about 360 by Monday afternoon.
Based on observed activity, attackers may be inspecting environments and searching for credentials and other sensitive information on compromised or exposed systems.
VulnCheck vice president of threat research Caitlin Condon commented on observed requests including retrieving Langflow environment variables associated with administrator credentials, OpenAI API keys, and AWS access credentials.
A number of other files were examined by the attackers, including the /root/.cache/langflow/secret_key file, access information related to SSH, and .bash_history.
Telemetry indicated that most of the source traffic was originating from Russia, but the initial attacks were observed only against VulnCheck canary systems in the United Kingdom. It has been noted that subsequent activity has expanded to additional locations, indicating that the exploitation process is no longer limited to those initially targeted.
The Langflow platform has previously been attacked only in limited instances during the period 2026, as reported by VulnCheck. However, 11 additional vulnerabilities have been identified and are currently being exploited in the wild. Langflow has historically seen limited exploitation activity. More than 15,000 successful attacks against instances affected by CVE-2026-0769, CVE-2025-3248, and CVE-2026-5027 have been recorded. This activity shows that Langflow compromises can extend beyond the platform itself as well.
Attackers were reported to have combined an unauthenticated remote code execution vulnerability, CVE-2026-33017, with an insecure direct object reference vulnerability, CVE-2026-55255, in a campaign observed on June 25, 2012. This campaign targeted approximately 7,000 servers to obtain API keys for OpenAI and Anthropic, as well as credentials for Amazon Web Services, Google Cloud, and Microsoft Azure, and connection details to the database.
Through such activities, exposed AI application infrastructure is an excellent source of credentials, which can allow access to cloud services, databases, and model providers. By incorporating sensitive tokens into AI workflows, an initial compromise may have a greater impact, particularly when those credentials are reused across a variety of services.
Langflow has also gained increasing attention as an integral part of the enterprise attack surface rather than being an isolated development tool as a result of the increasing number of attacks. Security teams monitoring deployments are therefore expected to account for credentials, configuration files and connected services which can be accessed upon successful compromise.
This ongoing exploitation illustrates the growing security concerns associated with internet-facing artificial intelligence infrastructure.
An organization should closely monitor Langflow deployments, secure sensitive credentials, and limit unnecessary external exposure in order to reduce the impact of a successful attack.
