CVE-2026-126081: Rails Action Pack mass assignment bypass in Parameters#each_key

CVE-2026-126081 · Severity: high · CVSS 7.5 · Published 2026-11-10

Rails is a web application framework that handles HTTP requests and parameter processing. Action Pack, its core component, includes a security feature called Strong Parameters that prevents unauthorized attributes from being set during object creation or updates. A vulnerability in the each_key method bypasses this protection, allowing a remote attacker to set unpermitted attributes like authorization flags without authentication.

Technologies: Rails Action Pack, actionpack (RubyGems). Vendors: Rails, RubyGems.

Quick answers

Is CVE-2026-126081 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-126081 being exploited in the wild.
How severe is CVE-2026-126081?
High severity, with a CVSS score of 7.5, published 10 November 2026.
Which products and versions are affected?
Rails Action Pack before 8.1.4.1 and 8.0.5.2; actionpack (RubyGems) >= 8.1.0.beta1, < 8.1.4.1.
Is there a fix for CVE-2026-126081?
Yes: fixed in Rails Action Pack 8.1.4.1, 8.0.5.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126081 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-126081?
Check whether you run Rails Action Pack or actionpack (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: Rails Action Pack 8.1.4.1, 8.0.5.2

Technical details

ActionController::Parameters#each_key incorrectly delegates to an internal HashWithIndifferentAccess when called with a block, returning the hash instead of the Parameters instance. Since the hash does not respond to permitted?, mass assignment operations (new, assign_attributes, update) accept it without raising ActiveModel::ForbiddenAttributesError. An attacker can craft a request that exploits applications passing the return value of each_key to mass assignment, bypassing Strong Parameters validation. This is a bypass of mass assignment protection requiring no authentication.

Affected products

  • Rails Action Pack before 8.1.4.1 and 8.0.5.2

Identifiers

  • CVE-2026-126081
  • GHSA-wm3x-v3qw-4jh3

Timeline

  • 2026-11-10: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.