CVE-2026-126073

Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, Action Pack negotiates the format of a rendered response from the Accept, X-Requested-With and, for XHR requests without Accept, Content-Type request headers, but ActionController::Rendering#_set_vary_header adds Vary: Accept only when the request carries a usable Accept header and the response has no Vary header yet. A response to a request without Accept, or to an XHR request, therefore omits the headers that selected its representation, and a response whose Vary the application set before rendering (for example Vary: Accept-Language) never gains Accept. A shared cache that honours Vary could store such a response and serve it to later clients that request a different representation, possibly leading to cache poisoning in which visitors receive, until the entry expires, a page without its layout or HTML in place of JSON. The attacker cannot choose the content of the response. Applications that render negotiated responses from actions marked public (for example with expires_in ..., public: true) behind a shared cache that honours Vary, such as Thruster or Rack::Cache, are affected. This issue is fixed in versions 8.1.4.1 and 8.0.5.2.

• CWE-436

• https://github.com/rails/rails/commit/7a955ca36779938267c93902c47d1f55bab99b4b
• https://github.com/rails/rails/commit/b58c107abe9c1f10c1d6a4941402c60e4dc4742c
• https://github.com/rails/rails/releases/tag/v8.0.5.2
• https://github.com/rails/rails/releases/tag/v8.1.4.1
• https://github.com/rails/rails/security/advisories/GHSA-r9jg-fmfx-2gv6

Published

Nov 10, 2026

Last Modified

Nov 12, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-126067Action Pack is a framework for handling and responding to we…3.1
• CVE-2026-126068Action Mailbox routes incoming emails to controller-like mai…3.7
• CVE-2026-126069Action View is a framework for handling view template lookup…4.7
• CVE-2026-126070Action View is a framework for handling view template lookup…6.1
• CVE-2026-126071Active Storage makes it simple to upload and reference files…5.3
• CVE-2026-126072Action Pack is a framework for handling and responding to we…5.9
• CVE-2026-126074Active Storage makes it simple to upload and reference files…4.3
• CVE-2026-126075Active Support is a collection of utility classes and standa…4.7
• CVE-2026-126076Action Pack is a framework for handling and responding to we…4.2
• CVE-2026-126077Action Pack is a framework for handling and responding to we…6.8
• CVE-2026-126078Action View is a framework for handling view template lookup…6.1
• CVE-2026-126079Action View is a framework for handling view template lookup…6.1