Is CVE-2026-126083 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-126083 being exploited in the wild.

How severe is CVE-2026-126083?

High severity, with a CVSS score of 7.4, published 10 November 2026.

Which products and versions are affected?

Rails Action Pack 8.1.0 through 8.1.4; actionpack (RubyGems) >= 8.1.0.beta1, < 8.1.4.1, ECOSYSTEM:introduced=8.1.0.beta1,fixed=8.1.4.1.

How is CVE-2026-126083 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-126083?

Check whether you run Rails Action Pack or actionpack (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126083: Rails Action Pack remote IP spoofing in request handling

Q: Is there a fix for CVE-2026-126083?

Yes. actionpack (RubyGems): upgrade to 8.1.4.1 or later. Until then: Configure your reverse proxy to remove or overwrite the Forwarded header before it reaches the Rails application, preventing client-supplied header values from being processed. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-126083 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-126083?

Check whether you run Rails Action Pack or actionpack (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126083 · Severity: high · CVSS 7.4 · Published 2026-11-10

Rails Action Pack, a framework that processes web requests, contains an IP spoofing vulnerability in versions 8.1.0 through 8.1.4 when running on Rack 3. An attacker can forge their client IP address to bypass IP-based access controls, rate limits, and falsify logging records. This is particularly dangerous for applications that rely on client IP addresses to enforce security policies.

Technologies: Rails Action Pack, actionpack (RubyGems). Vendors: Rails, RubyGems.

Quick answers

Is CVE-2026-126083 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-126083 being exploited in the wild.
How severe is CVE-2026-126083?: High severity, with a CVSS score of 7.4, published 10 November 2026.
Which products and versions are affected?: Rails Action Pack 8.1.0 through 8.1.4; actionpack (RubyGems) >= 8.1.0.beta1, < 8.1.4.1, ECOSYSTEM:introduced=8.1.0.beta1,fixed=8.1.4.1.
Is there a fix for CVE-2026-126083?: Yes. actionpack (RubyGems): upgrade to 8.1.4.1 or later. Until then: Configure your reverse proxy to remove or overwrite the Forwarded header before it reaches the Rails application, preventing client-supplied header values from being processed. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126083 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-126083?: Check whether you run Rails Action Pack or actionpack (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

actionpack (RubyGems): upgrade to 8.1.4.1 or later
```
bundle update actionpack
```

Configure your reverse proxy to remove or overwrite the Forwarded header before it reaches the Rails application, preventing client-supplied header values from being processed.

Technical details

ActionDispatch::RemoteIp in Rails 8.1 derives request.remote_ip from Rack::Request#forwarded_for, which under Rack 3 prioritizes the RFC 7239 Forwarded header over X-Forwarded-For. When a reverse proxy appends the client address to X-Forwarded-For but passes through an unmodified client-supplied Forwarded header, the IP spoofing check fails because it only compares Client-Ip with forwarded addresses, allowing an attacker to spoof their IP address. The vulnerability requires the application to be behind a proxy that does not remove or overwrite the Forwarded header and to rely on request.remote_ip for access control or rate limiting; the fix is available in version 8.1.4.1.

Affected products

Rails Action Pack 8.1.0 through 8.1.4

Identifiers

CVE-2026-126083
GHSA-2gff-2mmg-m73p

Timeline

2026-11-10: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.