IT SBIT Services
Schneeberger
DEEN
CVE tracker

Action Pack: Session cookie leak via Set-Cookie in Active Storage proxy responses

CVE-2026-126077Medium 6.8

← All vulnerabilities

Summary

Action Pack rewrites signed or encrypted cookies that were issued under a rotated secret or in a :hybrid serializer migration format. This rewrite ignores the setting that keeps the session cookie off a response. Active Storage proxy responses are public and cacheable, so a Set-Cookie header carrying a session can be stored by a shared cache and served to other users. The issue requires the Active Storage proxy, a cookie rotation or :hybrid serializer migration, and a cache that stores Set-Cookie on public responses. It also bypasses the earlier fix for CVE-2024-26144.

Affected

  • Action Pack (Rails) 8.1 before 8.1.4.1
  • Action Pack (Rails) 8.0 before 8.0.5.2
  • Rails 7.2 and older: unknown

Fixed in

  • Rails 8.1.4.1
  • Rails 8.0.5.2 (8.0 security support has ended; 8.1.4.1 is the realistic target)

Workaround

  • No configuration-only workaround is documented.
  • Configure caching proxies so they do not store responses that carry Set-Cookie headers.

Exploitation

  • No known exploitation in the wild found at the time of research. CISA KEV status not checked.
  • No public proof of concept found. This does not prove that none exists.
  • NVD analysis was still pending at the time of research.

Our recommendation

  • Upgrade to Rails 8.1.4.1 (or 8.0.5.2 if 8.1 cannot be adopted yet).
  • Check whether config.action_dispatch.cookies_rotations or the :hybrid cookie serializer is configured.
  • Check whether Active Storage proxy routes are reachable through a caching layer, and stop caching responses with Set-Cookie headers.
  • Upgrade together with the other fixes in the same release, notably GHSA-f3w6-w445-fwh9 (Active Storage file write and read, rated critical).

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 10:16.

Original description (NVD)

Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, When ActionDispatch::Cookies reads a signed or encrypted cookie that was written under a rotated secret (config.action_dispatch.cookies_rotations) or in the format that a :hybrid cookie serializer migrates from, it writes the cookie back to the response in the current format, and that write ignores request.session_options[:skip]. ActiveStorage::DisableSession relies on that option to keep the session cookie off the public, immutable responses of the Active Storage proxy controllers, but those controllers still load the session, so a request carrying an old-format session cookie could receive the rewritten session cookie in Set-Cookie on a cacheable response. A shared cache that stores such a response together with its Set-Cookie header could then serve one user's session to later requesters of the same URL, or serve an attacker's session to other users. Applications are affected when they serve Active Storage files through the proxy controllers, have a cookie rotation or a :hybrid serializer migration configured, and run behind a cache that stores Set-Cookie on public responses. This is a path around the fix for CVE-2024-26144. This issue is fixed in versions 8.1.4.1 and 8.0.5.2.

NVD references (5)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed