CVE-2026-126068

Name of the Vulnerable Software and Affected Versions Rails versions prior to 8.1.4.1 Rails versions prior to 8.0.5.2

Description The Action Mailbox Mailgun ingress authenticates requests using an HMAC of the timestamp and token parameters concatenated without a separator. The ActionMailbox::Ingresses::Mailgun::InboundEmailsController::Authenticator#recent? function only rejects timestamps more than 2 minutes in the past. Since the signature does not fix the boundary between these two values, a captured signed request can be modified with a timestamp far in the future, allowing the ingress to accept it indefinitely. An attacker with a single signed Mailgun webhook request could submit arbitrary inbound emails that the system processes as genuine, potentially leading to forged messages attributed to any sender.

Recommendations Update to version 8.1.4.1 or newer. Update to version 8.0.5.2 or newer. Synchronize the server clock to ensure it does not run more than 2 minutes behind Mailgun's clock to avoid rejecting genuine webhooks.