Answer in brief
CVE-2026-126067 records a Low severity (CVSS 3.1) vulnerability in Action Pack: Missing SameSite attribute on session cookies from Action Pack session stores. The current sources do not mark it as known exploited. The current feed maps rails/rails (generic), actionpack (rubygems), actionpack (rubygems). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 3.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps rails/rails (generic), actionpack (rubygems), actionpack (rubygems). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| rails/railsgeneric | >=8.1 <8.1.4.1 || <8.0.5.2 | 8.0.5.2, 8.1.4.1 |
| actionpackrubygems | <8.0.5.2 | 8.0.5.2 |
| actionpackrubygems | >=8.1.0.beta1,<8.1.4.1 | 8.1.4.1 |
Published upstream
Nov 10, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 10, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 10, 2026
Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, Action Pack session stores other than ActionDispatch::Session::CookieStore (CacheStore, MemCacheStore, and third-party stores built on AbstractStore, AbstractSecureStore or the session mixins) write the session cookie without a SameSite attribute, regardless of config.action_dispatch.cookies_same_site_protection, which defaults to :lax. Only CookieStore applies the configured policy. In browsers that do not treat a cookie without the attribute as SameSite=Lax, a cross-site request could carry the session cookie, possibly leading to cross-site request forgery against actions that do not verify an authenticity token, such as those of API-only applications. Applications are affected when they use a session store other than CookieStore and do not pass same_site: to config.session_store. This issue is fixed in versions 8.1.4.1 and 8.0.5.2.
Quoted source text, attributed separately from HOL analysis.