CVE-2026-126084

Name of the Vulnerable Software and Affected Versions Active Storage versions prior to 8.1.4.1 Active Storage versions prior to 8.0.5.2

Description When a GCS service is configured with the cache control option, the url for direct upload() function in ActiveStorage::Service::GCSService signs direct-upload URLs using V4, but the signature only covers the Host and Cache-Control headers. This allows a client to specify an arbitrary Content-Type or omit the Content-MD5 without invalidating the URL. Because GCS prioritizes the supplied content type as object metadata over the response-content-type set by Active Storage, an attacker could upload an object served as inline HTML on the storage origin. This could enable the registration of a Service Worker scoped to the bucket path, allowing the attacker to read or replace subsequent responses for signed URLs within that bucket.

Recommendations Update to version 8.1.4.1 or newer. Update to version 8.0.5.2 or newer.