# CVE-2026-126083: Rails Action Pack remote IP spoofing in request handling

Source: https://junglewise.ai/threats/cve-2026-126083-action-pack-is-a-framework-for-handling-and-responding-to-web  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-126083 · Severity: high · CVSS 7.4 · Published 2026-11-10

Rails Action Pack, a framework that processes web requests, contains an IP spoofing vulnerability in versions 8.1.0 through 8.1.4 when running on Rack 3. An attacker can forge their client IP address to bypass IP-based access controls, rate limits, and falsify logging records. This is particularly dangerous for applications that rely on client IP addresses to enforce security policies.

Technologies: [Rails Action Pack](https://junglewise.ai/threats/technologies/action-pack), [actionpack (RubyGems)](https://junglewise.ai/threats/technologies/actionpack). Vendors: [Rails](https://junglewise.ai/threats/vendors/rails), [RubyGems](https://junglewise.ai/threats/vendors/rubygems).

## Quick answers

**Is CVE-2026-126083 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-126083 being exploited in the wild.

**How severe is CVE-2026-126083?** High severity, with a CVSS score of 7.4, published 10 November 2026.

**Which products and versions are affected?** Rails Action Pack 8.1.0 through 8.1.4; actionpack (RubyGems) >= 8.1.0.beta1, < 8.1.4.1, ECOSYSTEM:introduced=8.1.0.beta1,fixed=8.1.4.1.

**Is there a fix for CVE-2026-126083?** Yes. actionpack (RubyGems): upgrade to 8.1.4.1 or later. Until then: Configure your reverse proxy to remove or overwrite the Forwarded header before it reaches the Rails application, preventing client-supplied header values from being processed. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-126083 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-126083?** Check whether you run Rails Action Pack or actionpack (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- actionpack (RubyGems): upgrade to 8.1.4.1 or later

  ```sh
  bundle update actionpack
  ```


Configure your reverse proxy to remove or overwrite the Forwarded header before it reaches the Rails application, preventing client-supplied header values from being processed.

## Technical details

ActionDispatch::RemoteIp in Rails 8.1 derives request.remote_ip from Rack::Request#forwarded_for, which under Rack 3 prioritizes the RFC 7239 Forwarded header over X-Forwarded-For. When a reverse proxy appends the client address to X-Forwarded-For but passes through an unmodified client-supplied Forwarded header, the IP spoofing check fails because it only compares Client-Ip with forwarded addresses, allowing an attacker to spoof their IP address. The vulnerability requires the application to be behind a proxy that does not remove or overwrite the Forwarded header and to rely on request.remote_ip for access control or rate limiting; the fix is available in version 8.1.4.1.

## Affected products

- Rails Action Pack 8.1.0 through 8.1.4

## Identifiers

- CVE-2026-126083
- GHSA-2gff-2mmg-m73p

## Timeline

- 2026-11-10: disclosed

## Related threats

- [Rails Action Pack mass assignment bypass in Parameters#each_key](https://junglewise.ai/threats/cve-2026-126081-action-pack-is-a-framework-for-handling-and-responding-to-web)
- [Rails Action Pack session cookie exposure in cached responses](https://junglewise.ai/threats/cve-2026-126077-action-pack-is-a-framework-for-handling-and-responding-to-web)
- [Ruby on Rails Action Pack session restoration after logout](https://junglewise.ai/threats/cve-2026-126076-action-pack-is-a-framework-for-handling-and-responding-to-web)
- [Rails Action Pack cache poisoning via content-type negotiation](https://junglewise.ai/threats/cve-2026-126073-action-pack-is-a-framework-for-handling-and-responding-to-web)
- [Rails Action Pack thread exhaustion in ActionController::Live](https://junglewise.ai/threats/cve-2026-126072-action-pack-is-a-framework-for-handling-and-responding-to-web)