CVE-2026-126083

Name of the Vulnerable Software and Affected Versions Action Pack versions 8.1 through 8.1.4

Description ActionDispatch::RemoteIp derives request.remote ip from Rack::Request#forwarded for, which under Rack 3 prioritizes the RFC 7239 Forwarded header over X-Forwarded-For. If a reverse proxy appends the client address to X-Forwarded-For but allows a client-supplied Forwarded header to pass through unchanged, request.remote ip may return an address chosen by the client. This occurs because the IP spoofing check only compares Client-Ip with forwarded addresses. An unauthenticated attacker can spoof request.remote ip to bypass IP-based access controls, evade rate limits keyed on the client address (such as the default by: of rate limit), and falsify client addresses in logs.

Recommendations Update Action Pack to version 8.1.4.1. Configure reverse proxies to remove or overwrite any client-supplied Forwarded header. As a workaround for applications whose proxies set X-Forwarded-For, set Rack::Request.forwarded priority = [:x forwarded] in an initializer to make Rack ignore the Forwarded header.