rails Action Pack prior 8.0.5.2/8.1.4.1 Session Store cross-site request forgery

Summaryinfo

A vulnerability classified as problematic was found in rails Action Pack. This affects an unknown function of the component Session Store. Executing a manipulation can lead to cross-site request forgery. This vulnerability appears as CVE-2026-126067. The attack may be performed from remote. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as problematic was found in rails Action Pack. This vulnerability affects an unknown function of the component Session Store. The manipulation with an unknown input leads to a cross-site request forgery vulnerability. The CWE definition for the vulnerability is CWE-352. The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. As an impact it is known to affect integrity. CVE summarizes:

Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, Action Pack session stores other than ActionDispatch::Session::CookieStore (CacheStore, MemCacheStore, and third-party stores built on AbstractStore, AbstractSecureStore or the session mixins) write the session cookie without a SameSite attribute, regardless of config.action_dispatch.cookies_same_site_protection, which defaults to :lax. Only CookieStore applies the configured policy. In browsers that do not treat a cookie without the attribute as SameSite=Lax, a cross-site request could carry the session cookie, possibly leading to cross-site request forgery against actions that do not verify an authenticity token, such as those of API-only applications. Applications are affected when they use a session store other than CookieStore and do not pass same_site: to config.session_store. This issue is fixed in versions 8.1.4.1 and 8.0.5.2.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-126067 since 11/10/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available.

Upgrading to version 8.0.5.2 or 8.1.4.1 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• rails

Name

• Action Pack

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion