CVE-2026-126067 Action Pack: Missing SameSite attribute on session cookies from Action Pack session stores
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-126067?
CVE-2026-126067 is a low-severity vulnerability in rails, published on 10 Nov 2026.
Official description
Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, Action Pack session stores other than ActionDispatch::Session::CookieStore (CacheStore, MemCacheStore, and third-party stores built on AbstractStore, AbstractSecureStore or the session mixins) write the session cookie without a SameSite attribute, regardless of config.action_dispatch.cookies_same_site_protection, which defaults to :lax. Only CookieStore applies the configured policy. In browsers that do not treat a cookie without the attribute as SameSite=Lax, a cross-site request could carry the session cookie, possibly leading to cross-site request forgery against actions that do not verify an authenticity token, such as those of API-only applications. Applications are affected when they use a session store other than CookieStore and do not pass same_site: to config.session_store. This issue is fixed in versions 8.1.4.1 and 8.0.5.2.
Weakness: CWE-352
Which versions are affected by CVE-2026-126067?
2 open source packages ship an affected version, including actionpack.
| Package | Affected | Fixed in |
|---|---|---|
actionpack RubyGems | All versions | 8.0.5.2 |
actionpack RubyGems | From 8.1.0.beta1 | 8.1.4.1 |
How do I fix CVE-2026-126067?
Upgrade actionpack to a fixed version for your release line: 8.0.5.2 or 8.1.4.1.
Is CVE-2026-126067 being exploited?
There is no known exploitation of CVE-2026-126067 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-126067, GHSA-gmj8-hvj3-49mw, UBUNTU-CVE-2026-126067.