CVE-2026-66066: Critical Rails Active Storage Flaw – Patch Immediately
Just catching up on the latest disclosures and wanted to flag CVE-2026-66066 for anyone running Ruby on Rails. This is a critical vulnerability (CVSS 9.5) affecting Active Storage that allows unauthenticated attackers to read arbitrary files via a crafted image upload.
The mechanics of this flaw are particularly dangerous because it requires no authentication. By uploading a specifically manipulated image file, an attacker can bypass validations and trick the server into serving sensitive system files. Successful exploitation could expose environment variables, the secret_key_base, the Rails master key, database credentials, and cloud storage keys.
Given how common Active Storage is for handling user uploads, this has a massive blast radius. If an attacker gets the secret_key_base, they can sign their own session cookies and effectively take over any application instance.
Immediate Actions:
- Patch Now: Apply the latest Rails security releases immediately.
- Audit Uploads: If you can't patch instantly, inspect your
config/storage.ymland restrict public access to upload endpoints.
You can quickly check your current Rails version in your environment:
rails version
For detection, start hunting your logs for requests to Active Storage endpoints that result in 200 OK statuses but have suspicious User-Agents or odd image metadata sizes.
How are you guys handling the rollout for large Rails fleets? Is anyone seeing active exploitation in the wild yet, or are we ahead of the curve?
The implications for session hijacking here are terrifying. Once you have that secret_key_base, you don't need to exploit SQL injection; you just cryptographically sign your own cookie and become admin. I'd recommend rotating all secrets immediately after patching, as you can't know if you were already compromised before the fix.
Patching our staging environment now, but prod is going to take a minute due to the regression tests. As a temporary mitigation, we are blocking upload endpoints at the WAF level for non-internal IPs. It's crude, but it buys us time. Here is the Lua snippet we are using if anyone needs it:
lua if string.match(uri, "/rails/active_storage") then return ngx.exit(403) end
Good catch. I'm also seeing reports that this affects some image processing gems that wrap Active Storage. Make sure you audit your Gemfile.lock for any dependencies that might rely on the vulnerable variations. Don't just patch Rails; check the whole dependency tree.
If you suspect exploitation before patching, audit your active_storage_blobs table immediately. Attackers often use minimized payloads to test the traversal logic. You can quickly check for recently created, unusually small image files in the Rails console to hunt for artifacts:
ActiveStorage::Blob.where("byte_size ?', 1.day.ago)
This helps identify potential testing activity before the actual data exfiltration occurs.
Verified Access Required
To maintain the integrity of our intelligence feeds, only verified partners and security professionals can post replies.
Request Access