Detections on VulnCheck's canaries climb from 50 to 360 amid Langflow, Rails exploitation
The probes read Langflow's secret key file and grep the process environment for OpenAI and AWS credentials, which puts an AI orchestration tool on the same scanning clock as the Rails file-read bug of the same week.
The Watch · Security desk
What happened
- VulnCheck recorded more than 50 detections within a few hours on August 30, 2026, and 360 by the Monday it reported, without splitting the total by CVE.
- CVE-2026-0768, rated CVSS 9.8, is an input validation failure in Langflow that runs attacker-supplied Python as the root user.
- VulnCheck counted more than 7,100 exposed vulnerable Ruby on Rails instances as of early August, before the CVE-2026-66066 exploitation it observed against canaries.
Why it matters
- What it limits constraint Applying the Rails 8.1.3.1 update no longer closes the ticket, because the deserialization path survives the patch and any signing key already read out stays useful to the attacker.
- Who's exposed exposure A Langflow host is a credential store as much as a workflow tool, so one root execution reaches the cloud accounts and model APIs whose keys sit in its environment.
- What's now possible capability Disabling auditd before chaining a second CVE means the responder inherits a host with no local audit trail for the pivot that followed.
- Who has to decide decision Whoever owns exposure scanning has to decide whether AI development platforms enter the same inventory and patch cadence as the web frameworks, since attackers already treat them that way.
Next story · Security · Oct 5
China-based actor targets U.S. Rejetto HFS servers through a forgeable admin cookieConfirmed4 publishers
The probe strings look like they were written by someone with the software open. LANGFLOW_SUPERUSER is the application's own admin credential, and /root/.cache/langflow/secret_key signs its tokens. OPENAI_API*, AWS_ACCESS* and AWS_SECRET* are the keys that get an attacker off the host and into a cloud tenant, while the checks on .ssh access and .bash_history size are triage for where to go next [3]. All of it lands as root, because CVE-2026-0768 executes attacker-supplied Python in the root context [1].
The arithmetic on the growth: 360 divided by 50 is 7.2, and that is a ceiling rather than a rate, because VulnCheck's early figure was stated as more than 50 [2][18]. The start of the window is dated to August 30, 2026. The endpoint is given only as "Monday" [2]. The 360 is also not broken out by CVE in VulnCheck's account, though the strings quoted alongside it are Langflow-specific [2][3].
The Rails half of the week is where the patch math gets awkward. CVE-2026-66066, CVSS 9.5, lets an unauthenticated attacker read arbitrary files and leak the Rails process environment, including secret_key_base, the master key, database passwords and cloud storage credentials [8]. Exploitation needs a crafted image upload and an app that uses libvips for Active Storage processing and accepts uploads from untrusted users [9]. VulnCheck says Active Storage always enables the libvips loaders that are unsafe for untrusted content [15]. It then tested a patched 8.1.3.1 server and found the fix blocks the libvips file read but does not neutralize the variation-key Marshal deserialization, so the RCE gadget still executes given a valid signature [16]. If the pre-patch read already yielded the signing key, the upgrade closes the door the attacker used to get the key, not the door the key opens.
The Langflow activity sits inside a longer pattern. VulnCheck counts 12 vulnerabilities exploited since 2025, with more than 15,000 successful attempts across CVE-2026-0769, CVE-2025-3248 and CVE-2026-5027 [5]. On its canaries, one crew used CVE-2026-5027 to drop a Python credential harvester, proxy agents and SimpleHelp for remote access [11]. Another used CVE-2025-3248 for an XMR miner, disabled auditd to create a forensic blind spot, exploited CVE-2026-0769 to drop .sysd, then scanned outward and moved on [12]. That is commodity operators cycling an exploit set, not a single actor's private bug.
Attribution, kept separate. VulnCheck says the Langflow source traffic comes primarily from Russia and has so far hit only its UK canaries [4]. For the Rails exploitation against canaries in Singapore, Israel and the UK [13], researcher Patrick Garrity said in a LinkedIn post that the traffic comes from a single IP address in France with command and control to a host in Israel [14]. One publisher, one post, one IP.
Most vulnerable Langflow hosts are in the US, Germany, Malaysia, Brazil and India [10]. An internet-reachable instance holding model and cloud keys is an application server with credentials in its environment, and the detection curve says it is being scanned like one [3][7].
What to watch
- Whether Rails ships a follow-up fix that neutralizes the variation-key Marshal deserialization path left open in 8.1.3.1.
- Whether Langflow probing spreads beyond VulnCheck's UK canaries to the US and Germany, where most vulnerable hosts sit.
- Whether the single French source IP behind the Rails exploitation gets tied to a named crew or stays unattributed.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence62
- Adoption40
- Hype gap+15
- Incentives65
- Confidence60
Perspective Coverage
4 publishers- Builder
- Builder 30%
- Operator
- Operator 60%
- Investor
- Investor 10%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
CVE-2026-0768 (CVSS 9.8) is a lack of proper validation of user-supplied input in Langflow that can be exploited to execute arbitrary Python code in the context of the root user.
- [2]
VulnCheck said it recorded more than 50 detections within a few hours on August 30, 2026, a figure that had risen to 360 as of Monday; the account does not break the 360 out by CVE.
- [3]
Caitlin Condon, vice president of threat research at VulnCheck, said adversaries appear to be conducting a mix of reconnaissance and credential harvesting: attacker requests query environment variables (LANGFLOW_SUPERUSER, OPENAI_API*, AWS_ACCESS*, AWS_SECRET*), read /root/.cache/langflow/secret_key, and check .ssh access and .bash_history size.
- [4]
VulnCheck said the source traffic originates primarily from Russia and has thus far exclusively hit its canaries in the United Kingdom.
- [5]
Threat actors have exploited as many as 12 vulnerabilities since 2025, with more than 15,000 successful attempts leveraging CVE-2026-0769, CVE-2025-3248 and CVE-2026-5027.
- [6]
VulnCheck reported that threat actors are exploiting two critical flaws affecting Langflow and Ruby on Rails.
- [7]
The findings highlight increased threat actor interest in AI development platforms, which can provide access to sensitive credentials, cloud environments and other connected systems.
- [8]
CVE-2026-66066, also called KindaRails2Shell (CVSS 9.5), allows an unauthenticated attacker to read arbitrary files from the server and leak the Rails process environment and secrets including secret_key_base, the Rails master key, database passwords, cloud storage credentials and API tokens, ultimately leading to remote code execution.
- [9]
CVE-2026-66066 is exploited by uploading a crafted image that abuses a discrepancy between Active Storage and libvips in how they read input files; successful exploitation requires the app to use libvips for Active Storage image processing and to accept image uploads from untrusted users.
- [10]
The majority of vulnerable Langflow hosts are located in the United States, Germany, Malaysia, Brazil and India.
- [11]
In one case against VulnCheck canary systems, unknown threat actors exploited CVE-2026-5027 to drop a Python credential harvester, proxy agents and SimpleHelp for remote access.
- [12]
In another case, attackers weaponized CVE-2025-3248 to enlist the machine into an XMR cryptocurrency miner botnet, then disabled auditd to create a forensic blind spot, exploited CVE-2026-0769 to drop .sysd, pivoted to scan for other targets to expand the cryptomining operation, and moved on to another host.
- [13]
VulnCheck has also detected active exploitation of CVE-2026-66066 targeting its canaries in Singapore, Israel and the United Kingdom.
- [14]
In a LinkedIn post, security researcher Patrick Garrity said the CVE-2026-66066 activity originates from a single IP address in France and establishes command-and-control to a host in Israel.
- [15]
VulnCheck said Active Storage always enables the libvips loaders that are unsafe for untrusted content, so any app that renders image-upload variants with the default vips processor can be coerced into loading a malicious upload.
- [16]
VulnCheck tested a patched 8.1.3.1 server and found that while the fix blocks the libvips file read, it does not neutralize the variation-key Marshal deserialization: the RCE gadget still executes on a patched server given a valid signature.
- [17]
As of early August, VulnCheck identified more than 7,100 exposed vulnerable instances of Ruby on Rails.
- [18]
Dividing the reported detection counts gives a factor of 7.2, which is a ceiling on the growth multiple because the earlier figure was stated as more than 50 rather than exactly 50.
Sources
4 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comCritical Langflow flaw exploited to steal OpenAI and AWS keys
2 articles · September 2, 2026
- securityaffairs.comHackers Target Langflow in CVE-2026-0768 Attacks
1 article · September 2, 2026
- securityweek.comHackers Start Exploiting Critical Langflow Vulnerability
1 article · September 1, 2026
- thehackernews.comAttackers Exploit Critical Langflow and Rails Flaws in Credential-Probing and C2 Activity
2 articles · September 1, 2026
Topics and entities
Topics
- Vulnerability Exploitation
- AI Application Security
- Honeypot Threat Intelligence
- Credential Theft and Stealer Logs