CVE-2026-34785: 
Ruby vulnerability analysis and mitigation

CVE-2026-34785 is an information disclosure vulnerability in Rack, the modular Ruby web server interface, caused by a flawed prefix-matching implementation in Rack::Static. When configured with URL prefixes such as /css, the middleware matches any request path beginning with that string — including unrelated paths like /css-config.env or /css-backup.sql — potentially serving sensitive files unintentionally. Affected versions are Rack < 2.2.23, >= 3.0.0.beta1 and < 3.1.21, and >= 3.2.0 and < 3.2.6. The vulnerability was published on April 1–2, 2026, and carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Github Advisory).

The root cause is a partial string comparison flaw (CWE-187) in Rack::Static#route_file, which uses logic equivalent to @urls.any? { |url| path.index(url) == 0 } — checking only whether the request path starts with the configured prefix, without enforcing a path segment boundary (i.e., a trailing /). This means a configuration of urls: ["/css", "/js"] intended to serve only files within those directories will also match sibling files like /css-config.env, /css-backup.sql, or /csssecrets.yml if they exist under the static root, resulting in unauthorized exposure of sensitive information (CWE-200). Exploitation requires no authentication, no special privileges, and no user interaction — an attacker simply crafts an HTTP GET request to a path that shares the configured prefix (GitHub Advisory).

Successful exploitation allows unauthenticated remote attackers to retrieve files from the configured static root that were never intended to be publicly accessible. Exposed content may include environment files (.env), database backups (.sql), YAML configuration files containing credentials, API keys, or other secrets. The impact is limited to confidentiality — there is no integrity or availability impact — but credential exposure could enable further lateral movement or account compromise in downstream systems (Github Advisory, GitHub Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time (Github Advisory). The EPSS score is approximately 0.049% (16th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the attack requires no authentication and low complexity, making it straightforward to exploit opportunistically if sensitive files are present under the static root.

1. Reconnaissance: Identify web applications built on Ruby/Rack (e.g., Rails, Sinatra) that use Rack::Static middleware with configured URL prefixes such as /css, /js, or /assets.
2. Enumerate static root contents: Guess or enumerate filenames under the static root that share the configured prefix but are not intended to be public (e.g., /css-config.env, /css-backup.sql, /js-secrets.yml).
3. Craft malicious HTTP request: Send a simple HTTP GET request to the target server using a path that matches the prefix but points to a sensitive file, e.g., GET /css-config.env HTTP/1.1.
4. Receive sensitive file contents: If the file exists under the static root, Rack::Static forwards the request to the file server and returns the file contents in the HTTP response, potentially exposing credentials, database connection strings, or backup data (GitHub Advisory).

• Network: Unusual HTTP GET requests to paths that share a configured static URL prefix but do not correspond to expected static assets (e.g., GET /css-config.env, GET /js-backup.sql, GET /assets-secrets.yml).
• Logs: Web server or Rack access logs showing 200 OK responses for requests to non-standard file extensions (.env, .sql, .yml, .bak) under paths matching configured static prefixes.
• File System: Presence of sensitive files (environment files, SQL dumps, YAML configs) under the directory configured as the Rack::Static root (e.g., public/).

Upgrade Rack to a patched version: 2.2.23 (for the 2.x branch), 3.1.21 (for the 3.0–3.1 branch), or 3.2.6 (for the 3.2 branch). The fix enforces a path segment boundary after the configured prefix, matching only paths exactly equal to the prefix or beginning with prefix + "/". As an interim workaround, avoid placing sensitive files under the Rack::Static root directory and use URL prefix mappings that cannot overlap with sensitive filenames. Audit server logs to identify any prior exploitation attempts (GitHub Advisory, Github Advisory).

The vulnerability was coordinated and published by Rack maintainer ioquatix, with th4s1s credited as the reporter and jeremyevans as the remediation reviewer (GitHub Advisory). IBM issued multiple security bulletins addressing this CVE across several products including IBM Aspera Faspex, IBM Aspera Enterprise WebApps, IBM Aspera Shares, IBM API Connect, IBM CloudPak for AIOps, and IBM License Metric Tool. Ubuntu issued security notice USN-8182-1, and SUSE published security updates (SUSE-SU-2026:1745-1 and SUSE-SU-2026:1964-1) addressing the vulnerability in their distributions.