Because this vulnerability requires no authentication and targets the default image processor in modern Rails environments, it is essential to apply vendor patches and rotate secrets immediately. A new Rapid Rule adds a targeted layer of defense in depth.
We have recently been tracking a critical vulnerability in Ruby on Rails, dubbed “KindaRails2Shell” (tracked as CVE-2026-66066). The flaw allows an unauthenticated attacker to read arbitrary files from the server, which can be escalated into remote code execution (RCE).
The issue resides within the Active Storage component when processing images via libvips. This has been the default image processor for Rails applications since version 7.0.
The Akamai Security Intelligence Group coordinated with Ethiack for vulnerability intelligence to ensure robust, accurate protection mechanisms against this threat.
Akamai App & API Protector customers already benefit from Adaptive Security Engine coverage against malicious file uploads and command injection. In addition, we have deployed a new Rapid Rule specific to this KindaRails2Shell attack.
CVE-2026-66066 is a severe arbitrary file read and RCE vulnerability affecting the Active Storage component of Ruby on Rails. The flaw carries a CVSS score of 9.5 (Critical) and represents a significant risk to organizations that are running applications that handle user-uploaded images.
The vulnerability is rooted in how Active Storage interacts with the libvips library to generate image variants. The libvips processor contains certain “unfuzzed” operations intended for file formats unrelated to standard web images. Because these operations are unsafe for handling untrusted content, and Active Storage fails to adequately disable them, an attacker can exploit this pathway.
By uploading a specially crafted file, an attacker can trigger these unsafe operations, granting them the ability to read arbitrary files from the server's file system. Most critically, this includes the application's process environment, which exposes highly sensitive secrets, such as the secret_key_base, cloud storage credentials, and database passwords.
The following activestorage versions are notably affected:
The three-step attack lifecycle bridges the gap between a simple file upload and complete server compromise:
The attacker uploads a specially crafted image file to a web application endpoint that accepts untrusted user uploads. This step requires no authentication or user credentials.
When Active Storage attempts to generate a variant of the image, the underlying libvips processor is tricked into invoking an unsafe operation. This unintended behavior allows the attacker to extract arbitrary files from the server, particularly the environment variables containing the secret_key_base.
With the secret_key_base compromised, the attacker holds the master cryptographic key to the application. They can forge session cookies, sign global IDs, and manipulate serialized data, which directly translates into full RCE on the underlying server.
Any application that is running a vulnerable version of Rails is at risk if it meets two conditions:
It is critical to note that simply upgrading Rails is not enough protection if a compromise has already occurred. Administrators must assume that environment secrets have been exposed and rotate all application secrets, including the secret_key_base, database passwords, and third-party API tokens.
Akamai App & API Protector customers already benefit from Adaptive Security Engine coverage designed to detect and block malicious uploads and injection attempts. This provides baseline protection against the techniques used to exfiltrate data and execute code.
On July 29, 2026, we deployed a new Rapid Rule to provide targeted, defense-in-depth coverage for variants specific to this Rails threat:
3000989 v1 — Rails2Shell Exploit Attempt Detected (CVE-2026-66066)
A new rule within Akamai App & API Protector has been deployed to protect our customers from the KindaRails2Shell threat. This new rule complements the code injection and malicious payload coverage that was already in place.
Although web application firewall (WAF) rules can identify and block known exploit patterns, the most effective defense is to promptly apply the patches provided by the vendor and rotate any potentially compromised credentials. Given the critical severity of CVE-2026-66066, administrators should apply updates to Rails and libvips immediately.
We encourage other vulnerability research companies to share their findings with us in advance.
We would like to thank Ethiack for providing valuable vulnerability intelligence in advance of this announcement, which helped us ensure robust, accurate protection mechanisms.
The Akamai Security Intelligence Group will continue to monitor, report on, and create mitigations for threats such as these for both our customers and the security community at large. To keep up with more breaking news from the Akamai Security Intelligence Group, check out our research home page and follow us on social media.
© 2026 Akamai Technologies
