CVE-2026-126073: Rails Action Pack cache poisoning via content-type negotiation

CVE-2026-126073 · Severity: medium · CVSS 4.8 · Published 2026-11-10

Action Pack is a Ruby on Rails framework component that handles web request processing and response formatting. A cache poisoning vulnerability allows shared caches to store responses without proper Vary headers, causing users to receive incorrect content formats (e.g., JSON data instead of HTML pages) until the cached entry expires. This affects publicly cached responses served through intermediate caches like Thruster or Rack::Cache.

Technologies: Rails Action Pack, actionpack (RubyGems). Vendors: Rails, RubyGems.

Quick answers

Is CVE-2026-126073 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-126073 being exploited in the wild.
How severe is CVE-2026-126073?
Medium severity, with a CVSS score of 4.8, published 10 November 2026.
Which products and versions are affected?
Rails Action Pack before 8.1.4.1 and 8.0.5.2; actionpack (RubyGems) >= 8.1, < 8.1.4.1, ECOSYSTEM:introduced=8.1,fixed=8.1.4.1.
Is there a fix for CVE-2026-126073?
Yes. actionpack (RubyGems): upgrade to 8.1.4.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126073 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-126073?
Check whether you run Rails Action Pack or actionpack (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • actionpack (RubyGems): upgrade to 8.1.4.1 or later
    bundle update actionpack

Technical details

Action Pack negotiates response format from Accept, X-Requested-With, and Content-Type headers but fails to consistently set the Vary response header with these negotiation headers. When an application renders negotiated responses with public caching directives, a shared cache may store the response without proper Vary headers and serve it to subsequent clients requesting different representations, resulting in cache poisoning. The fix ensures Vary headers include Accept and Content-Type for XHR requests.

Affected products

  • Rails Action Pack before 8.1.4.1 and 8.0.5.2

Identifiers

  • CVE-2026-126073
  • GHSA-r9jg-fmfx-2gv6

Timeline

  • 2026-11-10: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.