CVE-2026-126077

Name of the Vulnerable Software and Affected Versions Action Pack versions prior to 8.1.4.1 Action Pack versions prior to 8.0.5.2

Description Action Pack is a framework for handling and responding to web requests. An issue exists where ActionDispatch::Cookies reads a signed or encrypted cookie written under a rotated secret (config.action dispatch.cookies rotations) or in a format that a :hybrid cookie serializer migrates from. The system writes the cookie back to the response in the current format, ignoring request.session options[:skip]. Because ActiveStorage::DisableSession relies on this option to keep session cookies off public, immutable responses of Active Storage proxy controllers, a request with an old-format session cookie may result in a rewritten session cookie being sent in the Set-Cookie header of a cacheable response. If a shared cache stores this response and its Set-Cookie header, it could serve one user's session to subsequent requesters of the same URL or serve an attacker's session to other users. This occurs when applications serve Active Storage files through proxy controllers, have cookie rotation or a :hybrid serializer migration configured, and operate behind a cache that stores Set-Cookie on public responses.

Recommendations Update to version 8.1.4.1. Update to version 8.0.5.2.