CVE-2026-66066: Critical Ruby on Rails Vulnerability Exposes Secrets and Credentials

# CVE-2026-66066: Critical Ruby on Rails Vulnerability Exposes Secrets and Credentials

Ruby on Rails maintainers have released security updates to fix a serious flaw in the Active Storage component. Tracked as CVE-2026-66066 with a CVSS score of 9.5, the vulnerability allows an unauthenticated attacker to read arbitrary files from the server. The biggest risk is the exposure of the `SECRET_KEY_BASE` and other credentials, with the real possibility of remote code execution and lateral movement to other systems.

## Active Storage Failed to Disable libvips’ “unfuzzed” Operations

The root cause lies in the interaction between Active Storage and libvips, the library used to process user-uploaded images. Within libvips, certain operations are classified as *unfuzzed*, meaning they are dangerous when applied to untrusted content. These operations should be disabled in such cases, but Active Storage was not doing so.  

A specially crafted image file can therefore force the reading of any file accessible to the application process: environment variables, configuration files, and most importantly Rails’ `SECRET_KEY_BASE` and credentials for databases, external APIs, and cloud services. The attack only requires that an unauthenticated user can upload an image—a common feature in many web applications.

The libvips version is critical. Only from release 8.13 does the library offer an explicit control to disable “unfuzzed” operations. Earlier versions lack this protection, making the update doubly necessary: Active Storage must be patched to request the disabling, and libvips must be able to enforce it.

## From File Reading to Code Execution: Why the Danger Is Extreme

Reading arbitrary files is already a severe incident, but here the damage can quickly escalate. With the `SECRET_KEY_BASE`, an attacker can forge sessions, generate valid tokens, and in many scenarios achieve remote code execution by exploiting deserialization mechanisms or other framework features. Credentials for external systems (databases, storage, APIs) then pave the way for lateral movement: from the Rails application, attackers can pivot to other infrastructure components, extending the compromise.

The CVSS score of 9.5 reflects this chain: an easy attack vector (image upload), no authentication required, and extreme impact on confidentiality, integrity, and availability. According to Rapid7, as of July 30, no active exploitation had been detected in the wild. However, the absence of public exploits does not lessen the urgency: the window between disclosure and the first attack attempts can shrink to just a few hours.

## How to Secure Your Application

Patches for Active Storage are available in versions 7.2.3.2, 8.0.5.1, and 8.1.3.1. Anyone using a supported version should apply the update immediately. At the same time, libvips must be upgraded to release 8.13 or later; without this step, the Rails-side fix would be ineffective because the library cannot disable the dangerous operations.

There is an additional critical step: secret rotation. If the application was exposed before the update, all credentials accessible to the process—session keys, `SECRET_KEY_BASE`, API tokens, database passwords, cloud credentials—must be immediately replaced. Applying the patch without rotating secrets would essentially leave the door open for anyone who had already extracted credentials beforehand.

Finally, it is advisable to check application and system logs for anomalous access or suspicious image uploads, even though the nature of the attack (file reading) may not leave obvious traces.