Answer in brief
CVE-2026-126068 records a Low severity (CVSS 3.7) vulnerability in Action Mailbox: Possible signature replay in Action Mailbox Mailgun ingress. The current sources do not mark it as known exploited. The current feed maps rails/rails (generic), actionmailbox (rubygems), actionmailbox (rubygems). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 3.7. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps rails/rails (generic), actionmailbox (rubygems), actionmailbox (rubygems). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| rails/railsgeneric | >=8.1 <8.1.4.1 || <8.0.5.2 | 8.0.5.2, 8.1.4.1 |
| actionmailboxrubygems | <8.0.5.2 | 8.0.5.2 |
| actionmailboxrubygems | >=8.1.0.beta1,<8.1.4.1 | 8.1.4.1 |
Published upstream
Nov 10, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 10, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 10, 2026
Action Mailbox routes incoming emails to controller-like mailboxes for processing in Rails. Prior to 8.1.4.1 and 8.0.5.2, the Action Mailbox Mailgun ingress authenticates a request with an HMAC of the timestamp and token parameters concatenated without a separator, and ActionMailbox::Ingresses::Mailgun::InboundEmailsController::Authenticator#recent? rejects only timestamps more than 2 minutes in the past. Because the signature does not fix the boundary between the two values, a captured signed request can be presented with a timestamp far in the future, which the ingress then accepts indefinitely. An attacker who obtains one signed Mailgun webhook request, but not the signing key, could submit arbitrary inbound email that Action Mailbox processes as genuine, possibly leading to forged messages attributed to the sender of the attacker's choosing. Applications that receive inbound email through the Action Mailbox Mailgun ingress are affected. This issue is fixed in versions 8.1.4.1 and 8.0.5.2.
Quoted source text, attributed separately from HOL analysis.