{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-126067", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-11-10T17:07:43.283Z", "datePublished": "2026-11-10T20:29:44.430Z", "dateUpdated": "2026-11-10T20:29:44.430Z"}, "containers": {"cna": {"title": "Action Pack: Missing SameSite attribute on session cookies from Action Pack session stores", "problemTypes": [{"descriptions": [{"cweId": "CWE-352", "lang": "en", "description": "CWE-352: Cross-Site Request Forgery", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/rails/rails/security/advisories/GHSA-gmj8-hvj3-49mw", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/rails/rails/security/advisories/GHSA-gmj8-hvj3-49mw"}, {"name": "https://github.com/rails/rails/commit/2d9f502df941e31ce9bad0e846564f49396bed46", "tags": ["x_refsource_MISC"], "url": "https://github.com/rails/rails/commit/2d9f502df941e31ce9bad0e846564f49396bed46"}, {"name": "https://github.com/rails/rails/commit/f2392996be723708271a8d30bfcf0edc221e53ef", "tags": ["x_refsource_MISC"], "url": "https://github.com/rails/rails/commit/f2392996be723708271a8d30bfcf0edc221e53ef"}, {"name": "https://github.com/rails/rails/releases/tag/v8.0.5.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/rails/rails/releases/tag/v8.0.5.2"}, {"name": "https://github.com/rails/rails/releases/tag/v8.1.4.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/rails/rails/releases/tag/v8.1.4.1"}], "affected": [{"vendor": "rails", "product": "rails", "versions": [{"version": ">= 8.1, < 8.1.4.1", "status": "affected"}, {"version": "< 8.0.5.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-10T20:29:44.430Z"}, "descriptions": [{"lang": "en", "value": "Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, Action Pack session stores other than ActionDispatch::Session::CookieStore (CacheStore, MemCacheStore, and third-party stores built on AbstractStore, AbstractSecureStore or the session mixins) write the session cookie without a SameSite attribute, regardless of config.action_dispatch.cookies_same_site_protection, which defaults to :lax. Only CookieStore applies the configured policy. In browsers that do not treat a cookie without the attribute as SameSite=Lax, a cross-site request could carry the session cookie, possibly leading to cross-site request forgery against actions that do not verify an authenticity token, such as those of API-only applications. Applications are affected when they use a session store other than CookieStore and do not pass same_site: to config.session_store. This issue is fixed in versions 8.1.4.1 and 8.0.5.2."}], "source": {"advisory": "GHSA-gmj8-hvj3-49mw", "discovery": "UNKNOWN"}}}}

{}

{"affected": [{"affectedData": [{"product": "rails", "vendor": "rails", "versions": [{"status": "affected", "version": ">= 8.1, < 8.1.4.1"}, {"status": "affected", "version": "< 8.0.5.2"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, Action Pack session stores other than ActionDispatch::Session::CookieStore (CacheStore, MemCacheStore, and third-party stores built on AbstractStore, AbstractSecureStore or the session mixins) write the session cookie without a SameSite attribute, regardless of config.action_dispatch.cookies_same_site_protection, which defaults to :lax. Only CookieStore applies the configured policy. In browsers that do not treat a cookie without the attribute as SameSite=Lax, a cross-site request could carry the session cookie, possibly leading to cross-site request forgery against actions that do not verify an authenticity token, such as those of API-only applications. Applications are affected when they use a session store other than CookieStore and do not pass same_site: to config.session_store. This issue is fixed in versions 8.1.4.1 and 8.0.5.2."}], "id": "CVE-2026-126067", "lastModified": "2026-11-10T21:19:24.653", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2026-11-10T21:19:24.653", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/rails/rails/commit/2d9f502df941e31ce9bad0e846564f49396bed46"}, {"source": "security-advisories@github.com", "url": "https://github.com/rails/rails/commit/f2392996be723708271a8d30bfcf0edc221e53ef"}, {"source": "security-advisories@github.com", "url": "https://github.com/rails/rails/releases/tag/v8.0.5.2"}, {"source": "security-advisories@github.com", "url": "https://github.com/rails/rails/releases/tag/v8.1.4.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/rails/rails/security/advisories/GHSA-gmj8-hvj3-49mw"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{"bugzilla": {"description": "actionpack: Action Pack: Cross-Site Request Forgery via missing SameSite attribute on session cookies", "id": "2571214", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2571214"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N", "status": "draft"}, "cwe": "CWE-346", "details": ["A flaw was found in Action Pack. Certain non-cookie session stores fail to apply the configured SameSite attribute when issuing session cookies. In web browsers that do not automatically enforce cross-site cookie restrictions, a remote attacker could induce an authenticated user's browser to send requests carrying their session cookie. This flaw can lead to Cross-Site Request Forgery (CSRF), allowing an attacker to execute unauthorized actions on behalf of the victim against application endpoints that do not verify authenticity tokens."], "mitigation": {"lang": "en:us", "value": "Explicitly configure the `same_site` attribute when declaring the session store in the Rails application configuration (such as in `config/application.rb` or an environment file in `config/environments/`):\n```ruby\nconfig.session_store :cache_store, same_site: :lax\n```\nSubstitute `:cache_store` with the specific session store utilized by the application, such as `:mem_cache_store`.\nCaveats:\nEnforcing `:lax` or `:strict` SameSite policies may alter cookie transmission during third-party redirects or external identity federation flows. Ensure integrations with external authentication providers function as expected.\nWarning: Modifying application configuration requires restarting or reloading the application server processes (e.g., Puma, Passenger, or Unicorn) to take effect."}, "name": "CVE-2026-126067", "package_state": [{"cpe": "cpe:/a:redhat:3scale:2.13", "fix_state": "Out of support scope", "package_name": "3scale-amp2/system-rhel8", "product_name": "Red Hat 3scale API Management Platform 2"}, {"cpe": "cpe:/a:redhat:3scale:2.13", "fix_state": "Fix deferred", "package_name": "3scale-amp2/system-rhel9", "product_name": "Red Hat 3scale API Management Platform 2"}, {"cpe": "cpe:/a:redhat:3scale:2.13", "fix_state": "Fix deferred", "package_name": "3scale-amp2/zync-rhel9", "product_name": "Red Hat 3scale API Management Platform 2"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Fix deferred", "package_name": "rubygem-actionpack", "product_name": "Red Hat Satellite 6"}], "public_date": "2026-11-10T20:29:44Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-126067\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-126067\nhttps://github.com/rails/rails/commit/2d9f502df941e31ce9bad0e846564f49396bed46\nhttps://github.com/rails/rails/commit/f2392996be723708271a8d30bfcf0edc221e53ef\nhttps://github.com/rails/rails/releases/tag/v8.0.5.2\nhttps://github.com/rails/rails/releases/tag/v8.1.4.1\nhttps://github.com/rails/rails/security/advisories/GHSA-gmj8-hvj3-49mw"], "statement": "Red Hat rates the impact of this vulnerability as Low because successful exploitation requires multiple non-standard application preconditions and user interaction on non-default browser configurations. The issue only affects deployments utilizing alternative, non-cookie session stores that have not explicitly defined cookie protections, and whose endpoints do not enforce standard cross-site request forgery token validation. Furthermore, modern browsers enforce Lax cookie policies by default, substantially mitigating exposure under standard user environments.", "threat_severity": "Low"}

{}