# CVE-2026-126081: Rails Action Pack mass assignment bypass in Parameters#each_key

Source: https://junglewise.ai/threats/cve-2026-126081-action-pack-is-a-framework-for-handling-and-responding-to-web  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-126081 · Severity: high · CVSS 7.5 · Published 2026-11-10

Rails is a web application framework that handles HTTP requests and parameter processing. Action Pack, its core component, includes a security feature called Strong Parameters that prevents unauthorized attributes from being set during object creation or updates. A vulnerability in the each_key method bypasses this protection, allowing a remote attacker to set unpermitted attributes like authorization flags without authentication.

Technologies: [Rails Action Pack](https://junglewise.ai/threats/technologies/action-pack), [actionpack (RubyGems)](https://junglewise.ai/threats/technologies/actionpack). Vendors: [Rails](https://junglewise.ai/threats/vendors/rails), [RubyGems](https://junglewise.ai/threats/vendors/rubygems).

## Quick answers

**Is CVE-2026-126081 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-126081 being exploited in the wild.

**How severe is CVE-2026-126081?** High severity, with a CVSS score of 7.5, published 10 November 2026.

**Which products and versions are affected?** Rails Action Pack before 8.1.4.1 and 8.0.5.2; actionpack (RubyGems) >= 8.1.0.beta1, < 8.1.4.1.

**Is there a fix for CVE-2026-126081?** Yes: fixed in Rails Action Pack 8.1.4.1, 8.0.5.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-126081 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-126081?** Check whether you run Rails Action Pack or actionpack (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Rails Action Pack 8.1.4.1, 8.0.5.2

## Technical details

ActionController::Parameters#each_key incorrectly delegates to an internal HashWithIndifferentAccess when called with a block, returning the hash instead of the Parameters instance. Since the hash does not respond to permitted?, mass assignment operations (new, assign_attributes, update) accept it without raising ActiveModel::ForbiddenAttributesError. An attacker can craft a request that exploits applications passing the return value of each_key to mass assignment, bypassing Strong Parameters validation. This is a bypass of mass assignment protection requiring no authentication.

## Affected products

- Rails Action Pack before 8.1.4.1 and 8.0.5.2

## Identifiers

- CVE-2026-126081
- GHSA-wm3x-v3qw-4jh3

## Timeline

- 2026-11-10: disclosed

## References

- [https://github.com/rails/rails/commit/2fc8838300133931e19eed3ea6cee76a7e83f19c](https://github.com/rails/rails/commit/2fc8838300133931e19eed3ea6cee76a7e83f19c)
- [https://github.com/rails/rails/commit/8ba746e0a786458c281060823f2ccc5c5f6312ac](https://github.com/rails/rails/commit/8ba746e0a786458c281060823f2ccc5c5f6312ac)

## Related threats

- [Rails Action Pack remote IP spoofing in request handling](https://junglewise.ai/threats/cve-2026-126083-action-pack-is-a-framework-for-handling-and-responding-to-web)
- [Rails Action Pack session cookie exposure in cached responses](https://junglewise.ai/threats/cve-2026-126077-action-pack-is-a-framework-for-handling-and-responding-to-web)
- [Ruby on Rails Action Pack session restoration after logout](https://junglewise.ai/threats/cve-2026-126076-action-pack-is-a-framework-for-handling-and-responding-to-web)
- [Rails Action Pack cache poisoning via content-type negotiation](https://junglewise.ai/threats/cve-2026-126073-action-pack-is-a-framework-for-handling-and-responding-to-web)
- [Rails Action Pack thread exhaustion in ActionController::Live](https://junglewise.ai/threats/cve-2026-126072-action-pack-is-a-framework-for-handling-and-responding-to-web)