Critical Ruby on Rails Flaw CVE-2026-66066 Enables Unauthenticated RCE

Ruby on Rails maintainers have shipped emergency patches for a critical vulnerability, tracked as CVE-2026-66066 with a CVSS score of 9.5, that could let unauthenticated attackers achieve remote code execution (RCE) on vulnerable servers. The flaw, an arbitrary file read bug in Active Storage, allows attackers to access sensitive files from the application's filesystem, including environment variables containing secrets such as `secret_key_base` and credentials for external systems. Exposed `secret_key_base` values can be weaponized to forge session tokens, while stolen credentials provide a direct path to RCE and lateral movement across the network. Organizations running Rails apps should verify exposure by scanning their public-facing assets with a port scanner and confirm their TLS posture using an SSL/TLS checker.

The vulnerability stems from the way Active Storage handles image variants when paired with the libvips image-processing library. In its default configuration, a Rails application that renders image variants could allow an unauthenticated user to read arbitrary files from the server, including the process environment. Because libvips marks certain file read and write operations as "unfuzzed" (unsafe for untrusted content) and Active Storage failed to disable those operations, an attacker could upload a specially crafted file to trigger a dangerous operation and exfiltrate file contents. Applications using libvips for Active Storage image processing that accept uploads from untrusted users are confirmed to be in scope.

Patches have been released in Active Storage versions 7.2.3.2, 8.0.5.1, and 8.1.3.1. Administrators must also upgrade libvips to at least version 8.13, as earlier releases do not support disabling the unfuzzed operations that enable the exploit. The Rails team warns that simply upgrading closes the hole but does not remediate secrets that may already have been exfiltrated. Any application affected should treat every secret readable by its process as potentially compromised and rotate credentials immediately, including API keys, database passwords, and signing keys. Given the breadth of secrets typically housed in modern web stacks, defenders are advised to run a broader privacy checkup across their environments and audit external integrations that share credentials with the vulnerable Rails instance.

As of July 30, Rapid7 reported no evidence of active exploitation in the wild, but the trivial unauthenticated nature of the attack and the 9.5 severity rating make this a high-priority patching item. Security teams should prioritize inventorying all Ruby on Rails deployments, especially those exposed to the internet or integrated with cloud storage and CDNs, and confirm that both Active Storage and libvips are updated to the fixed versions. With credential theft as a clear downstream risk, organizations should also review authentication logs for anomalous activity and consider tightening session signing and access controls on any systems that share trust boundaries with the affected application.