CVE-2026-126067

Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, Action Pack session stores other than ActionDispatch::Session::CookieStore (CacheStore, MemCacheStore, and third-party stores built on AbstractStore, AbstractSecureStore or the session mixins) write the session cookie without a SameSite attribute, regardless of config.action_dispatch.cookies_same_site_protection, which defaults to :lax. Only CookieStore applies the configured policy. In browsers that do not treat a cookie without the attribute as SameSite=Lax, a cross-site request could carry the session cookie, possibly leading to cross-site request forgery against actions that do not verify an authenticity token, such as those of API-only applications. Applications are affected when they use a session store other than CookieStore and do not pass same_site: to config.session_store. This issue is fixed in versions 8.1.4.1 and 8.0.5.2.

• CWE-352

• https://github.com/rails/rails/commit/2d9f502df941e31ce9bad0e846564f49396bed46
• https://github.com/rails/rails/commit/f2392996be723708271a8d30bfcf0edc221e53ef
• https://github.com/rails/rails/releases/tag/v8.0.5.2
• https://github.com/rails/rails/releases/tag/v8.1.4.1
• https://github.com/rails/rails/security/advisories/GHSA-gmj8-hvj3-49mw

Published

Nov 10, 2026

Last Modified

Nov 12, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-126061Winter CMS is a content management system built on the Larav…4.3
• CVE-2026-126062Nokogiri is an open source XML and HTML library for the Ruby…3.7
• CVE-2026-126063Nokogiri is an open source XML and HTML library for the Ruby…2.3
• CVE-2026-126064Nokogiri is an open source XML and HTML library for the Ruby…2
• CVE-2026-126065OpenObserve is a cloud-native observability platform. Prior …9.8
• CVE-2026-126066fast-xml-parser allows users to process XML from JS object w…3.7
• CVE-2026-126068Action Mailbox routes incoming emails to controller-like mai…3.7
• CVE-2026-126069Action View is a framework for handling view template lookup…4.7
• CVE-2026-126070Action View is a framework for handling view template lookup…6.1
• CVE-2026-126071Active Storage makes it simple to upload and reference files…5.3
• CVE-2026-126072Action Pack is a framework for handling and responding to we…5.9
• CVE-2026-126073Action Pack is a framework for handling and responding to we…4.8