CVE-2026-126067
Description
A flaw was found in Action Pack. Certain non-cookie session stores fail to apply the configured SameSite attribute when issuing session cookies. In web browsers that do not automatically enforce cross-site cookie restrictions, a remote attacker could induce an authenticated user's browser to send requests carrying their session cookie. This flaw can lead to Cross-Site Request Forgery (CSRF), allowing an attacker to execute unauthorized actions on behalf of the victim against application endpoints that do not verify authenticity tokens.
Statement
Red Hat rates the impact of this vulnerability as Low because successful exploitation requires multiple non-standard application preconditions and user interaction on non-default browser configurations. The issue only affects deployments utilizing alternative, non-cookie session stores that have not explicitly defined cookie protections, and whose endpoints do not enforce standard cross-site request forgery token validation. Furthermore, modern browsers enforce Lax cookie policies by default, substantially mitigating exposure under standard user environments.
Mitigation
Explicitly configure the `same_site` attribute when declaring the session store in the Rails application configuration (such as in `config/application.rb` or an environment file in `config/environments/`):
ruby
config.session_store :cache_store, same_site: :lax
Substitute `:cache_store` with the specific session store utilized by the application, such as `:mem_cache_store`.
Caveats:
Enforcing `:lax` or `:strict` SameSite policies may alter cookie transmission during third-party redirects or external identity federation flows. Ensure integrations with external authentication providers function as expected.
Warning: Modifying application configuration requires restarting or reloading the application server processes (e.g., Puma, Passenger, or Unicorn) to take effect.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 3.1 | N/A | 3.1 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | Required | N/A | Required |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | Low | N/A | Low |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Understanding the Weakness (CWE)
Access Control,Other
Technical Impact: Gain Privileges or Assume Identity; Varies by Context
An attacker can access any functionality that is inadvertently accessible to the source.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
