Session Management Flaw in Action Pack Framework Affecting Rails
CVE-2026-126076
What is CVE-2026-126076?
Action Pack, a framework used in Ruby on Rails applications for handling web requests, has a vulnerability in its session management system. In versions prior to 8.1.4.1 and 8.0.5.2, the ActionDispatch::Session::CacheStore erroneously rewrites a user session back to the cache at the end of a web request without verifying if the session's cache entry still remains valid. This oversight allows for the possibility that a user’s session can be restored after it has been invalidated. If a logout request or a server-side cache deletion occurs concurrently, an attacker could retain access to an active session using a stolen session cookie, effectively bypassing user logout. The flaw affects applications that utilize config.session_store :cache_store with any backend cache system. However, applications using other session stores like ActionDispatch::Session::CookieStore or ActionDispatch::Session::MemCacheStore with Dalli version 4.0.0 or later are not vulnerable. This issue has been addressed in subsequent releases.
Affected Version(s)
rails >= 8.1, < 8.1.4.1 < 8.1, 8.1.4.1
rails < 8.0.5.2 < 8.0.5.2