CVE-2026-126077: Rails Action Pack session cookie exposure in cached responses

CVE-2026-126077 · Severity: medium · CVSS 6.8 · Published 2026-11-10

Rails Action Pack, a web framework component for handling HTTP requests, has a flaw where session cookies can be written to cacheable responses despite being marked to skip the session. When running behind a shared cache with cookie rotation or migration enabled, an attacker or another user's session cookie could be served from that cache to other requesters, enabling account takeover or session hijacking attacks.

Technologies: Rails Action Pack, actionpack (RubyGems). Vendors: Rails, RubyGems.

Quick answers

Is CVE-2026-126077 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-126077 being exploited in the wild.
How severe is CVE-2026-126077?
Medium severity, with a CVSS score of 6.8, published 10 November 2026.
Which products and versions are affected?
Rails Action Pack Prior to 8.1.4.1 and 8.0.5.2; actionpack (RubyGems) >= 8.1.0.beta1, < 8.1.4.1.
Is there a fix for CVE-2026-126077?
Yes: fixed in Action Pack 8.1.4.1, 8.0.5.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126077 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-126077?
Check whether you run Rails Action Pack or actionpack (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: Action Pack 8.1.4.1, 8.0.5.2

Technical details

When ActionDispatch::Cookies reads a signed or encrypted cookie that requires format upgrade (from rotated secrets or :hybrid serializer migration), it rewrites the cookie to the response without respecting request.session_options[:skip]. ActiveStorage::DisableSession relies on that option to exclude session cookies from public, cacheable proxy responses. In deployments behind a shared cache, this causes upgraded session cookies to be stored with Set-Cookie headers on cacheable responses, allowing one user's session to be served to other requesters of the same URL.

Affected products

  • Rails Action Pack Prior to 8.1.4.1 and 8.0.5.2

Identifiers

  • CVE-2026-126077
  • GHSA-x6mj-8jx9-qhqv

Timeline

  • 2026-11-10: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.