Rails Action Pack: Strong Parameters bypass in ActionController::Parameters#each_key
Summary
Action Pack, the request handling framework of Ruby on Rails, returns an internal hash instead of the Parameters object from ActionController::Parameters#each_key when a block is given. That hash does not carry the permitted? check, so Active Model mass assignment accepts it without raising ForbiddenAttributesError. An unauthenticated remote attacker could set attributes the application does not permit, such as an authorization flag, but only if the application passes the return value of each_key to mass assignment. Rails itself does not make this call. This CVE is an incomplete fix of CVE-2020-8164.
Affected
- Rails Action Pack 8.1 before 8.1.4.1
- Rails Action Pack 8.0 before 8.0.5.2
- Rails 7.2 and older: Unknown.
Fixed in
- Rails Action Pack 8.1.4.1
- Rails Action Pack 8.0.5.2
Workaround
- Do not pass the return value of ActionController::Parameters#each_key to mass assignment; pass the permitted Parameters object instead.
- Search the code for each_key calls on params (grep -rn 'each_key' app lib) and review each hit.
Exploitation
- No known exploitation at the time of research.
- No public proof of concept found.
Our recommendation
- Inventory all Rails applications and their versions (Gemfile.lock).
- Upgrade to Rails 8.1.4.1, or to 8.0.5.2 as a short-term step.
- Plan the migration from 8.0 to 8.1, because Rails 8.0 security support ends on 7 November 2026.
- Search the code for each_key calls on params that feed mass assignment and fix them.
- For Rails 7.2 and older, confirm with the Rails team whether this CVE applies.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE-2026-126081 Record www.cve.org
- GitHub Security Advisory GHSA-wm3x-v3qw-4jh3 github.com
- Fix commit 2fc8838 github.com
- Rails 8.1.4.1 release github.com
- Rails 8.0.5.2 release github.com
- Rails security releases 8.0.5.2 and 8.1.4.1 discuss.rubyonrails.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 04:50.
Original description (NVD)
Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, ActionController::Parameters#each_key delegates to the internal ActiveSupport::HashWithIndifferentAccess that holds the request parameters, so when called with a block it returns that hash instead of the Parameters instance. The hash does not respond to permitted?, so Active Model mass assignment (new, assign_attributes, update) accepts it without raising ActiveModel::ForbiddenAttributesError. An application that passes the return value of each_key to mass assignment could allow a remote, unauthenticated attacker to set attributes that the application does not permit, such as an authorization flag. This is an incomplete fix of CVE-2020-8164, which made each, each_pair and each_value return the Parameters instance but left each_key delegated. An application is affected if it passes the return value of ActionController::Parameters#each_key, called with a block, to mass assignment. Rails itself makes no such call. This issue is fixed in versions 8.1.4.1 and 8.0.5.2.
NVD references (5)
- https://github.com/rails/rails/commit/2fc8838300133931e19eed3ea6cee76a7e83f19c
- https://github.com/rails/rails/commit/8ba746e0a786458c281060823f2ccc5c5f6312ac
- https://github.com/rails/rails/releases/tag/v8.0.5.2
- https://github.com/rails/rails/releases/tag/v8.1.4.1
- https://github.com/rails/rails/security/advisories/GHSA-wm3x-v3qw-4jh3
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.