Web application vulnerability in Action Pack framework by Rails

CVE-2026-126077

What is CVE-2026-126077?

A vulnerability exists in the Action Pack framework prior to versions 8.1.4.1 and 8.0.5.2, where improper handling of signed or encrypted cookies can lead to session hijacking. When a cookie is read under outdated configurations, it is rewritten and can leak session information to unintended users through cacheable responses. This situation occurs particularly in applications using Active Storage proxy controllers that serve files behind shared caches and have cookie rotation or hybrid serializer migrations configured. It presents a significant risk of serving user sessions incorrectly, thus highlighting the need for immediate updates to the fixed versions.

References