CVE-2026-126076: Ruby on Rails Action Pack session restoration after logout

CVE-2026-126076 · Severity: medium · CVSS 4.2 · Published 2026-11-10

Action Pack is a Rails framework component that handles web requests and sessions. A race condition in its CacheStore session handling can cause a deleted session to be restored under its original ID when concurrent requests are processed, allowing an attacker with a stolen session cookie to remain authenticated even after the legitimate user logs out. This affects applications using cache-based session storage.

Technologies: Rails Action Pack, actionpack (RubyGems). Vendors: Rails, RubyGems.

Quick answers

Is CVE-2026-126076 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-126076 being exploited in the wild.
How severe is CVE-2026-126076?
Medium severity, with a CVSS score of 4.2, published 10 November 2026.
Which products and versions are affected?
Rails Action Pack before 8.1.4.1 and 8.0.5.2; actionpack (RubyGems) >= 8.1.0.beta1, < 8.1.4.1, ECOSYSTEM:introduced=8.1.0.beta1,fixed=8.1.4.1.
Is there a fix for CVE-2026-126076?
Yes. actionpack (RubyGems): upgrade to 8.1.4.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126076 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-126076?
Check whether you run Rails Action Pack or actionpack (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • actionpack (RubyGems): upgrade to 8.1.4.1 or later
    bundle update actionpack

Technical details

ActionDispatch::Session::CacheStore writes sessions back to the cache at request completion without verifying the cache entry still exists. If a concurrent request deletes the session (via reset_session or cache deletion), a slower request that loaded the session earlier will restore it under the original session ID. This is a race condition requiring concurrent request timing; CookieStore and MemCacheStore with Dalli 4.0.0+ are not affected.

Affected products

  • Rails Action Pack before 8.1.4.1 and 8.0.5.2

Identifiers

  • CVE-2026-126076
  • GHSA-2586-8ghr-69fj

Timeline

  • 2026-11-10: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.