CVE-2026-126067

Name of the Vulnerable Software and Affected Versions Action Pack versions prior to 8.1.4.1 Action Pack versions prior to 8.0.5.2

Description Session stores other than ActionDispatch::Session::CookieStore (including CacheStore, MemCacheStore, and third-party stores based on AbstractStore, AbstractSecureStore, or session mixins) write session cookies without a SameSite attribute. This occurs regardless of the config.action dispatch.cookies same site protection setting. In browsers that do not default missing attributes to SameSite=Lax, cross-site requests may include the session cookie. This can lead to cross-site request forgery (CSRF) against actions that do not verify authenticity tokens, such as those in API-only applications. The issue affects applications using a session store other than CookieStore that do not explicitly provide the same site: option to config.session store.

Recommendations Update to version 8.1.4.1 or newer. Update to version 8.0.5.2 or newer. As a temporary workaround, pass the same site: option when configuring the session store, such as config.session store :cache store, same site: :lax.