Ruby on Rails shipped emergency releases on July 29 for a critical vulnerability that lets an unauthenticated attacker read arbitrary files from a server — but the line administrators keep skipping is buried further down the advisory. Upgrading closes the hole. It does not unsteal anything already taken.
The Rails security team is explicit: an affected application should treat every secret readable by its own process as potentially exposed, and change it. That means secret_key_base, the master key, and everything inside config/credentials.yml.enc, S3 or GCS storage keys, database credentials, and third-party API tokens.
Rotating secret_key_base logs every user out and invalidates signed cookies and existing Active Storage URLs — which is precisely why teams will be tempted to skip it, and precisely why they shouldn't.
Tracked as CVE-2026-66066 and nicknamed KindaRails2Shell, the bug was reported independently by André Baptista, Bruno Mendes and Rafael Castilho of Portuguese firm Ethiack, and by researcher RyotaK at GMO Flatt Security. Both teams coordinated disclosure with Rails maintainers. Ethiack credits its inspiration plainly: "We named it KindaRails2Shell, because we found a rails2shell… kinda."
The flaw sits in Active Storage, the framework's built-in file attachment layer. Active Storage processes images through libvips, a fast image library that has shipped as the default since Rails 7.0. libvips flags certain format handlers as "unfuzzed" — untested against hostile input, and often handling formats that have nothing to do with web images.
Active Storage never disabled them. Upload a crafted file, get a variant generated, and an attacker can reach one of those handlers and start reading the filesystem, environment included.
Rails 7.0.0 through 7.2.3.1, 8.0.0 through 8.0.5, and 8.1.0 through 8.1.3 are exposed in stock configurations. Rails 6.x is only at risk with a customised Active Storage setup. Applications using the ImageMagick processor instead of vips are unaffected.
Patched versions are 7.2.3.2, 8.0.5.1 and 8.1.3.1. The fix requires libvips 8.13 or newer — older builds cannot disable the unsafe operations at all, and Active Storage will now refuse to boot on them. Teams that can't upgrade immediately can set the VIPS_BLOCK_UNTRUSTED environment variable, or call Vips.block_untrusted(true) in an initialiser on ruby-vips 2.2.1+.
Rails has committed to publishing full attack-chain details by August 28, and Flatt Security's own testing concluded an exploit could be reconstructed within hours using AI tooling once diffs go public. A WAF may slow that down depending on how uploads reach your app. It is not a substitute for the upgrade — or for the rotation.