# CVE-2026-126076: Ruby on Rails Action Pack session restoration after logout

Source: https://junglewise.ai/threats/cve-2026-126076-action-pack-is-a-framework-for-handling-and-responding-to-web  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-126076 · Severity: medium · CVSS 4.2 · Published 2026-11-10

Action Pack is a Rails framework component that handles web requests and sessions. A race condition in its CacheStore session handling can cause a deleted session to be restored under its original ID when concurrent requests are processed, allowing an attacker with a stolen session cookie to remain authenticated even after the legitimate user logs out. This affects applications using cache-based session storage.

Technologies: [Rails Action Pack](https://junglewise.ai/threats/technologies/action-pack), [actionpack (RubyGems)](https://junglewise.ai/threats/technologies/actionpack). Vendors: [Rails](https://junglewise.ai/threats/vendors/rails), [RubyGems](https://junglewise.ai/threats/vendors/rubygems).

## Quick answers

**Is CVE-2026-126076 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-126076 being exploited in the wild.

**How severe is CVE-2026-126076?** Medium severity, with a CVSS score of 4.2, published 10 November 2026.

**Which products and versions are affected?** Rails Action Pack before 8.1.4.1 and 8.0.5.2; actionpack (RubyGems) >= 8.1.0.beta1, < 8.1.4.1, ECOSYSTEM:introduced=8.1.0.beta1,fixed=8.1.4.1.

**Is there a fix for CVE-2026-126076?** Yes. actionpack (RubyGems): upgrade to 8.1.4.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-126076 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-126076?** Check whether you run Rails Action Pack or actionpack (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- actionpack (RubyGems): upgrade to 8.1.4.1 or later

  ```sh
  bundle update actionpack
  ```


## Technical details

ActionDispatch::Session::CacheStore writes sessions back to the cache at request completion without verifying the cache entry still exists. If a concurrent request deletes the session (via reset_session or cache deletion), a slower request that loaded the session earlier will restore it under the original session ID. This is a race condition requiring concurrent request timing; CookieStore and MemCacheStore with Dalli 4.0.0+ are not affected.

## Affected products

- Rails Action Pack before 8.1.4.1 and 8.0.5.2

## Identifiers

- CVE-2026-126076
- GHSA-2586-8ghr-69fj

## Timeline

- 2026-11-10: disclosed

## References

- [https://github.com/rails/rails/commit/5bb5ec66ed8faaf590ffe1222d7a5eb6e9d050f5](https://github.com/rails/rails/commit/5bb5ec66ed8faaf590ffe1222d7a5eb6e9d050f5)
- [https://github.com/rails/rails/commit/d479192cf88a8b30a335a8bc25188a2d8e0f8d9f](https://github.com/rails/rails/commit/d479192cf88a8b30a335a8bc25188a2d8e0f8d9f)

## Related threats

- [Rails Action Pack remote IP spoofing in request handling](https://junglewise.ai/threats/cve-2026-126083-action-pack-is-a-framework-for-handling-and-responding-to-web)
- [Rails Action Pack mass assignment bypass in Parameters#each_key](https://junglewise.ai/threats/cve-2026-126081-action-pack-is-a-framework-for-handling-and-responding-to-web)
- [Rails Action Pack session cookie exposure in cached responses](https://junglewise.ai/threats/cve-2026-126077-action-pack-is-a-framework-for-handling-and-responding-to-web)
- [Rails Action Pack cache poisoning via content-type negotiation](https://junglewise.ai/threats/cve-2026-126073-action-pack-is-a-framework-for-handling-and-responding-to-web)
- [Rails Action Pack thread exhaustion in ActionController::Live](https://junglewise.ai/threats/cve-2026-126072-action-pack-is-a-framework-for-handling-and-responding-to-web)