CVE-2026-55107 Splunk · SPL

Detect kobako Sandbox Escape to Host RCE (CVE-2026-55107) in Splunk

Detects exploitation of CVE-2026-55107, a critical (CVSS 10.0) sandbox escape in the kobako Ruby gem (versions >= 0.1.0, <= 0.9.0). kobako is intended to safely evaluate untrusted guest Ruby expressions, but its guest object forwards unknown methods through method_missing directly into public_send on any bound Service object. An attacker who can supply a guest expression can therefore invoke arbitrary public methods on host-side Service objects — chaining to send, instance_variable_get, or Service methods that reach system/eval — achieving host remote code execution. Detection focuses on the runtime side effects of an escape: Ruby/Rack worker processes (running kobako-backed evaluation) spawning shells, interpreters, reconnaissance binaries, or network tools; unexpected child processes of puma/unicorn/rails; and process-command-lines that reveal method_missing/public_send abuse patterns. Because the vulnerability lives inside a normally-sandboxed eval path, ANY OS command execution originating from the evaluating worker is high-signal.

MITRE ATT&CK

Tactic
Execution Privilege Escalation

SPL Detection Query

Splunk (SPL)
spl 
index=* (sourcetype=linux:audit OR sourcetype=sysmon OR sourcetype=osquery:process)
| eval parent=lower(coalesce(parent_process_name, ParentImage, parent))
| eval child=lower(coalesce(process_name, Image, name))
| where match(parent, "ruby|rails|puma|unicorn|rackup|sidekiq|bundle|irb")
| where match(child, "(^|/)(sh|bash|dash|zsh|nc|ncat|netcat|curl|wget|python3?|perl|id|whoami|uname|chmod|base64)$")
| search NOT (CommandLine="*assets:precompile*" OR CommandLine="*webpack*" OR CommandLine="*bundle install*")
| table _time host user parent child CommandLine process_id parent_process_id
| sort - _time
critical severity high confidence

Correlates process-execution telemetry to surface Ruby/Rack (kobako host) parents spawning shells or recon tools, indicating a guest-eval sandbox escape to host RCE.

Data Sources

Linux auditdSysmon for Linuxosquery process events

Required Sourcetypes

linux:auditsysmonosquery:process

False Positives & Tuning

  • Scheduled maintenance or deploy jobs where a Ruby parent shells out for asset builds.
  • Monitoring agents wrapping application processes that fork utility binaries.
  • Interactive irb/pry troubleshooting on non-production hosts.

Other platforms for CVE-2026-55107

Microsoft Sentinel (KQL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate kobako guest-eval escape to shell (lab)

    Expected signal: ProcessRollup2 / auditd process-exec event with parent ruby and child sh executing id and uname.

  2. Test 2Simulate host recon via escaped Ruby worker

    Expected signal: Process-launch events showing ruby spawning whoami and curl.

  3. Test 3Benign Ruby deploy shell-out (false-positive check)

    Expected signal: Process-launch event with parent ruby and child sh whose command line contains assets:precompile.

Last updated: 2026-08-22 Research depth: standard
References (3)

Response Playbook

Triage

  1. Identify the alerting host and confirm whether it runs an application embedding the kobako gem; run `gem list kobako` / inspect Gemfile.lock and confirm the version falls within >= 0.1.0, <= 0.9.0 (fixed in 0.9.1).
  2. Pull the full process tree for the flagged event: confirm the parent is a kobako-backed evaluation worker (puma/unicorn/rails) and inspect the child command line for shell, recon (id/whoami/uname), or network (curl/wget/nc) activity.
  3. Correlate the process timestamp with application/HTTP access logs to locate the inbound request or job that supplied the guest expression; look for payloads containing `public_send`, `method_missing`, `send`, `instance_variable_get`, or backtick/`system`/`eval` strings.
  4. Determine whether the spawned command succeeded and what it accessed (outbound connections, files read/written, credentials touched) to gauge blast radius.

Containment

  1. Isolate the affected host from the network to stop any established reverse shell or C2 channel while preserving volatile evidence.
  2. Disable or rate-limit the endpoint that accepts untrusted guest expressions, or take the kobako-backed feature offline until the gem is upgraded to 0.9.1+.
  3. Rotate any credentials, tokens, or secrets reachable from the application process, since host RCE exposes the full application environment.

Evidence Collection

  1. Capture the full process command lines, parent/child relationships, and environment of the offending worker process (e.g., from EDR timeline or /proc before termination).
  2. Preserve application logs, reverse-proxy/access logs, and the specific request/job payload that carried the guest expression.
  3. Collect network connection records (netstat/conntrack, firewall/proxy logs) for outbound connections initiated by the worker around the event time.

Escalation Criteria

  • !Escalate to incident response immediately if the spawned process established an outbound/reverse connection, wrote executables, or accessed credential material — treat as confirmed host RCE.
  • !Escalate if the same guest-expression payload pattern is observed against multiple hosts or repeatedly, indicating active campaign exploitation.
  • !Escalate to application owners and change management to force the kobako upgrade and validate no persistence (cron, systemd units, authorized_keys) was planted.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >Application worker process command lines and parent-child process tree showing ruby→shell transitions.
  • >Reverse-proxy / application access logs containing the guest expression payload (method_missing/public_send/send patterns).
  • >Newly created files, cron entries, systemd units, or authorized_keys modifications timestamped near the event.
  • >Outbound network connection logs from the worker process (potential reverse shell / C2).

Tuning Guidance

Baseline which Ruby application hosts legitimately shell out (asset compilation, media processing, deploy hooks) and add those specific parent+command patterns to the exclusion clause rather than removing the parent list. If kobako is confirmed absent, scope the rule to hosts running the affected application. Prioritize alerts where the child is a network tool (nc/curl/wget) or where the command line contains base64/decoded payloads, and lower priority for read-only recon (id/whoami) that may reflect benign health checks. Once all instances are patched to 0.9.1+, retain the rule as a defense-in-depth control for anomalous Ruby subprocess behavior.

Hunting Queries

Hunts for any Ruby/Rack application worker spawning shell or network utility children across the fleet — surfaces kobako escape attempts even when the specific recon binary differs from the detection allowlist.

Hunting — KQL
kql 
DeviceProcessEvents | where InitiatingProcessFileName has_any ("ruby","puma","unicorn","rails") | where FileName in~ ("sh","bash","nc","curl","wget","python3") | summarize count(), makeset(ProcessCommandLine) by DeviceName, bin(Timestamp, 1h)
Hunting — SPL
spl 
index=* (sourcetype=linux:audit OR sourcetype=sysmon) parent_process_name IN (ruby,puma,unicorn,rails) process_name IN (sh,bash,nc,curl,wget,python3) | stats count values(CommandLine) by host, parent_process_name

Atomic Red Team Tests

Test 1 Simulate kobako guest-eval escape to shell (lab)
linux

Emulates a kobako evaluator worker forking a shell as a result of a guest expression reaching host public_send, producing the parent→child telemetry the detection relies on.

Command

bash 
ruby -e 'system("/bin/sh -c \"id; uname -a\"")'

Cleanup

bash 
echo 'no cleanup required - read-only recon commands'

Expected Telemetry

ProcessRollup2 / auditd process-exec event with parent ruby and child sh executing id and uname.

Expected Detection

true

Test 2 Simulate host recon via escaped Ruby worker
linux

Runs reconnaissance binaries under a Ruby parent to mimic post-escape enumeration on the host.

Command

bash 
ruby -e 'exec("whoami")' &
ruby -e 'system("curl -s http://127.0.0.1:9/ || true")'

Cleanup

bash 
pkill -f 'ruby -e' 2>/dev/null || true

Expected Telemetry

Process-launch events showing ruby spawning whoami and curl.

Expected Detection

true

Test 3 Benign Ruby deploy shell-out (false-positive check)
linux

Executes a Ruby-parented asset-compilation-style shell command that should be excluded by the detection's tuning clause, validating false-positive handling.

Command

bash 
ruby -e 'system("sh -c \"echo assets:precompile done\"")'

Cleanup

bash 
echo 'no cleanup required'

Expected Telemetry

Process-launch event with parent ruby and child sh whose command line contains assets:precompile.

Related Detections

Tactic Hubs

TA0002ExecutionTA0004Privilege Escalation

Related Techniques

T1059.006PythonT1203Exploitation for Client ExecutionT1068Exploitation for Privilege Escalation

Same Tactic: Execution

Popular Detections