CVE-2026-126068

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-126068", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-11-10T17:07:43.283Z", "datePublished": "2026-11-10T20:32:29.130Z", "dateUpdated": "2026-11-10T20:56:58.752Z"}, "containers": {"cna": {"title": "Action Mailbox: Possible signature replay in Action Mailbox Mailgun ingress", "problemTypes": [{"descriptions": [{"cweId": "CWE-294", "lang": "en", "description": "CWE-294: Authentication Bypass by Capture-replay", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/rails/rails/security/advisories/GHSA-5957-c7qm-m469", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/rails/rails/security/advisories/GHSA-5957-c7qm-m469"}, {"name": "https://github.com/rails/rails/commit/4aa2ec66822bc4eb8b341a0608f1c90a3e371a34", "tags": ["x_refsource_MISC"], "url": "https://github.com/rails/rails/commit/4aa2ec66822bc4eb8b341a0608f1c90a3e371a34"}, {"name": "https://github.com/rails/rails/commit/c3a295c5c22266e8ec4d0e664e6923a299235e7a", "tags": ["x_refsource_MISC"], "url": "https://github.com/rails/rails/commit/c3a295c5c22266e8ec4d0e664e6923a299235e7a"}, {"name": "https://github.com/rails/rails/releases/tag/v8.0.5.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/rails/rails/releases/tag/v8.0.5.2"}, {"name": "https://github.com/rails/rails/releases/tag/v8.1.4.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/rails/rails/releases/tag/v8.1.4.1"}], "affected": [{"vendor": "rails", "product": "rails", "versions": [{"version": ">= 8.1, < 8.1.4.1", "status": "affected"}, {"version": "< 8.0.5.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-10T20:32:29.130Z"}, "descriptions": [{"lang": "en", "value": "Action Mailbox routes incoming emails to controller-like mailboxes for processing in Rails. Prior to 8.1.4.1 and 8.0.5.2, the Action Mailbox Mailgun ingress authenticates a request with an HMAC of the timestamp and token parameters concatenated without a separator, and ActionMailbox::Ingresses::Mailgun::InboundEmailsController::Authenticator#recent? rejects only timestamps more than 2 minutes in the past. Because the signature does not fix the boundary between the two values, a captured signed request can be presented with a timestamp far in the future, which the ingress then accepts indefinitely. An attacker who obtains one signed Mailgun webhook request, but not the signing key, could submit arbitrary inbound email that Action Mailbox processes as genuine, possibly leading to forged messages attributed to the sender of the attacker's choosing. Applications that receive inbound email through the Action Mailbox Mailgun ingress are affected. This issue is fixed in versions 8.1.4.1 and 8.0.5.2."}], "source": {"advisory": "GHSA-5957-c7qm-m469", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-10T20:56:47.334859Z", "id": "CVE-2026-126068", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-10T20:56:58.752Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-126068", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-11-10T17:07:43.283Z", "datePublished": "2026-11-10T20:32:29.130Z", "dateUpdated": "2026-11-10T20:56:58.752Z"}, "containers": {"cna": {"title": "Action Mailbox: Possible signature replay in Action Mailbox Mailgun ingress", "problemTypes": [{"descriptions": [{"cweId": "CWE-294", "lang": "en", "description": "CWE-294: Authentication Bypass by Capture-replay", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/rails/rails/security/advisories/GHSA-5957-c7qm-m469", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/rails/rails/security/advisories/GHSA-5957-c7qm-m469"}, {"name": "https://github.com/rails/rails/commit/4aa2ec66822bc4eb8b341a0608f1c90a3e371a34", "tags": ["x_refsource_MISC"], "url": "https://github.com/rails/rails/commit/4aa2ec66822bc4eb8b341a0608f1c90a3e371a34"}, {"name": "https://github.com/rails/rails/commit/c3a295c5c22266e8ec4d0e664e6923a299235e7a", "tags": ["x_refsource_MISC"], "url": "https://github.com/rails/rails/commit/c3a295c5c22266e8ec4d0e664e6923a299235e7a"}, {"name": "https://github.com/rails/rails/releases/tag/v8.0.5.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/rails/rails/releases/tag/v8.0.5.2"}, {"name": "https://github.com/rails/rails/releases/tag/v8.1.4.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/rails/rails/releases/tag/v8.1.4.1"}], "affected": [{"vendor": "rails", "product": "rails", "versions": [{"version": ">= 8.1, < 8.1.4.1", "status": "affected"}, {"version": "< 8.0.5.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-10T20:32:29.130Z"}, "descriptions": [{"lang": "en", "value": "Action Mailbox routes incoming emails to controller-like mailboxes for processing in Rails. Prior to 8.1.4.1 and 8.0.5.2, the Action Mailbox Mailgun ingress authenticates a request with an HMAC of the timestamp and token parameters concatenated without a separator, and ActionMailbox::Ingresses::Mailgun::InboundEmailsController::Authenticator#recent? rejects only timestamps more than 2 minutes in the past. Because the signature does not fix the boundary between the two values, a captured signed request can be presented with a timestamp far in the future, which the ingress then accepts indefinitely. An attacker who obtains one signed Mailgun webhook request, but not the signing key, could submit arbitrary inbound email that Action Mailbox processes as genuine, possibly leading to forged messages attributed to the sender of the attacker's choosing. Applications that receive inbound email through the Action Mailbox Mailgun ingress are affected. This issue is fixed in versions 8.1.4.1 and 8.0.5.2."}], "source": {"advisory": "GHSA-5957-c7qm-m469", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-126068", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-10T20:56:47.334859Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-10T20:56:54.115Z"}}]}}

{"affected": [{"affectedData": [{"product": "rails", "vendor": "rails", "versions": [{"status": "affected", "version": ">= 8.1, < 8.1.4.1"}, {"status": "affected", "version": "< 8.0.5.2"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Action Mailbox routes incoming emails to controller-like mailboxes for processing in Rails. Prior to 8.1.4.1 and 8.0.5.2, the Action Mailbox Mailgun ingress authenticates a request with an HMAC of the timestamp and token parameters concatenated without a separator, and ActionMailbox::Ingresses::Mailgun::InboundEmailsController::Authenticator#recent? rejects only timestamps more than 2 minutes in the past. Because the signature does not fix the boundary between the two values, a captured signed request can be presented with a timestamp far in the future, which the ingress then accepts indefinitely. An attacker who obtains one signed Mailgun webhook request, but not the signing key, could submit arbitrary inbound email that Action Mailbox processes as genuine, possibly leading to forged messages attributed to the sender of the attacker's choosing. Applications that receive inbound email through the Action Mailbox Mailgun ingress are affected. This issue is fixed in versions 8.1.4.1 and 8.0.5.2."}], "id": "CVE-2026-126068", "lastModified": "2026-11-12T22:18:35.610", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-126068", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-10T20:56:47.334859Z", "version": "2.0.3"}}]}, "published": "2026-11-10T21:19:24.810", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/rails/rails/commit/4aa2ec66822bc4eb8b341a0608f1c90a3e371a34"}, {"source": "security-advisories@github.com", "url": "https://github.com/rails/rails/commit/c3a295c5c22266e8ec4d0e664e6923a299235e7a"}, {"source": "security-advisories@github.com", "url": "https://github.com/rails/rails/releases/tag/v8.0.5.2"}, {"source": "security-advisories@github.com", "url": "https://github.com/rails/rails/releases/tag/v8.1.4.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/rails/rails/security/advisories/GHSA-5957-c7qm-m469"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-294"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{"bugzilla": {"description": "actionmailbox: Action Mailbox: Inbound email forgery via Mailgun webhook signature replay", "id": "2571201", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2571201"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.7", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "status": "draft"}, "cwe": "CWE-294", "details": ["A flaw was found in Action Mailbox. The Mailgun ingress controller fails to reject incoming webhook requests with timestamps set in the future and concatenates authentication parameters without a separator when verifying the Hash-based Message Authentication Code (HMAC) signature. A remote attacker who intercepts a single signed request can manipulate the parameters to reuse the signature indefinitely, enabling them to submit forged inbound emails that the application processes as genuine."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-126068", "package_state": [{"cpe": "cpe:/a:redhat:3scale:2.13", "fix_state": "Out of support scope", "package_name": "3scale-amp2/system-rhel8", "product_name": "Red Hat 3scale API Management Platform 2"}, {"cpe": "cpe:/a:redhat:3scale:2.13", "fix_state": "Fix deferred", "package_name": "3scale-amp2/system-rhel9", "product_name": "Red Hat 3scale API Management Platform 2"}, {"cpe": "cpe:/a:redhat:3scale:2.13", "fix_state": "Fix deferred", "package_name": "3scale-amp2/zync-rhel9", "product_name": "Red Hat 3scale API Management Platform 2"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Fix deferred", "package_name": "rubygem-actionmailbox", "product_name": "Red Hat Satellite 6"}], "public_date": "2026-11-10T20:32:29Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-126068\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-126068\nhttps://github.com/rails/rails/commit/4aa2ec66822bc4eb8b341a0608f1c90a3e371a34\nhttps://github.com/rails/rails/commit/c3a295c5c22266e8ec4d0e664e6923a299235e7a\nhttps://github.com/rails/rails/releases/tag/v8.0.5.2\nhttps://github.com/rails/rails/releases/tag/v8.1.4.1\nhttps://github.com/rails/rails/security/advisories/GHSA-5957-c7qm-m469"], "statement": "This vulnerability is rated as Low severity because successful exploitation requires an attacker to first intercept a valid webhook transaction, and the impact is confined to injecting forged inbound messages rather than compromising host confidentiality or service availability. Action Mailbox is not enabled or configured by default across Red Hat platforms, and exploitation is strictly limited to applications specifically deployed to ingest incoming mail through third-party Mailgun webhooks. Consequently, standard deployments are unaffected unless this optional integration is explicitly incorporated into custom application workflows.", "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[8.1,8.1.4.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,8.0.5.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "rails", "source": "cna", "vendor": "rails"}, "product": "rails", "vendor": "rails"}], "created": "2026-11-12T01:00:09.864789+00:00", "updated": "2026-11-13T12:45:14.816568+00:00", "vendors": ["rails", "rails$PRODUCT$rails"]}