CVE-2026-126073

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-126073", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-11-10T17:07:43.284Z", "datePublished": "2026-11-10T20:46:43.153Z", "dateUpdated": "2026-11-12T18:01:27.975Z"}, "containers": {"cna": {"title": "Action Pack: Possible cache poisoning in Action Pack content negotiation", "problemTypes": [{"descriptions": [{"cweId": "CWE-436", "lang": "en", "description": "CWE-436: Interpretation Conflict", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/rails/rails/security/advisories/GHSA-r9jg-fmfx-2gv6", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/rails/rails/security/advisories/GHSA-r9jg-fmfx-2gv6"}, {"name": "https://github.com/rails/rails/commit/7a955ca36779938267c93902c47d1f55bab99b4b", "tags": ["x_refsource_MISC"], "url": "https://github.com/rails/rails/commit/7a955ca36779938267c93902c47d1f55bab99b4b"}, {"name": "https://github.com/rails/rails/commit/b58c107abe9c1f10c1d6a4941402c60e4dc4742c", "tags": ["x_refsource_MISC"], "url": "https://github.com/rails/rails/commit/b58c107abe9c1f10c1d6a4941402c60e4dc4742c"}, {"name": "https://github.com/rails/rails/releases/tag/v8.0.5.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/rails/rails/releases/tag/v8.0.5.2"}, {"name": "https://github.com/rails/rails/releases/tag/v8.1.4.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/rails/rails/releases/tag/v8.1.4.1"}], "affected": [{"vendor": "rails", "product": "rails", "versions": [{"version": ">= 8.1, < 8.1.4.1", "status": "affected"}, {"version": "< 8.0.5.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-10T20:46:43.153Z"}, "descriptions": [{"lang": "en", "value": "Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, Action Pack negotiates the format of a rendered response from the Accept, X-Requested-With and, for XHR requests without Accept, Content-Type request headers, but ActionController::Rendering#_set_vary_header adds Vary: Accept only when the request carries a usable Accept header and the response has no Vary header yet. A response to a request without Accept, or to an XHR request, therefore omits the headers that selected its representation, and a response whose Vary the application set before rendering (for example Vary: Accept-Language) never gains Accept. A shared cache that honours Vary could store such a response and serve it to later clients that request a different representation, possibly leading to cache poisoning in which visitors receive, until the entry expires, a page without its layout or HTML in place of JSON. The attacker cannot choose the content of the response. Applications that render negotiated responses from actions marked public (for example with expires_in ..., public: true) behind a shared cache that honours Vary, such as Thruster or Rack::Cache, are affected. This issue is fixed in versions 8.1.4.1 and 8.0.5.2."}], "source": {"advisory": "GHSA-r9jg-fmfx-2gv6", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-12T16:26:31.033828Z", "id": "CVE-2026-126073", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-12T18:01:27.975Z"}}]}}

{}

{"affected": [{"affectedData": [{"product": "rails", "vendor": "rails", "versions": [{"status": "affected", "version": ">= 8.1, < 8.1.4.1"}, {"status": "affected", "version": "< 8.0.5.2"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, Action Pack negotiates the format of a rendered response from the Accept, X-Requested-With and, for XHR requests without Accept, Content-Type request headers, but ActionController::Rendering#_set_vary_header adds Vary: Accept only when the request carries a usable Accept header and the response has no Vary header yet. A response to a request without Accept, or to an XHR request, therefore omits the headers that selected its representation, and a response whose Vary the application set before rendering (for example Vary: Accept-Language) never gains Accept. A shared cache that honours Vary could store such a response and serve it to later clients that request a different representation, possibly leading to cache poisoning in which visitors receive, until the entry expires, a page without its layout or HTML in place of JSON. The attacker cannot choose the content of the response. Applications that render negotiated responses from actions marked public (for example with expires_in ..., public: true) behind a shared cache that honours Vary, such as Thruster or Rack::Cache, are affected. This issue is fixed in versions 8.1.4.1 and 8.0.5.2."}], "id": "CVE-2026-126073", "lastModified": "2026-11-12T22:09:39.233", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-126073", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-12T16:26:31.033828Z", "version": "2.0.3"}}]}, "published": "2026-11-10T21:19:25.563", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/rails/rails/commit/7a955ca36779938267c93902c47d1f55bab99b4b"}, {"source": "security-advisories@github.com", "url": "https://github.com/rails/rails/commit/b58c107abe9c1f10c1d6a4941402c60e4dc4742c"}, {"source": "security-advisories@github.com", "url": "https://github.com/rails/rails/releases/tag/v8.0.5.2"}, {"source": "security-advisories@github.com", "url": "https://github.com/rails/rails/releases/tag/v8.1.4.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/rails/rails/security/advisories/GHSA-r9jg-fmfx-2gv6"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-436"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "actionpack: Action Pack: Web cache poisoning via improper Vary header generation during content negotiation", "id": "2571250", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2571250"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L", "status": "draft"}, "cwe": "CWE-440", "details": ["A flaw was found in Action Pack. When determining response formats through content negotiation, Action Pack fails to properly set or append to the HTTP Vary response header under certain request conditions. A remote attacker can exploit this behavior by sending requests through a shared intermediary cache, causing the cache to store an improperly formatted response. This leads to web cache poisoning, where subsequent users receive unexpected response representations, such as HTML instead of JSON or unstyled web pages."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-126073", "package_state": [{"cpe": "cpe:/a:redhat:3scale:2.13", "fix_state": "Out of support scope", "package_name": "3scale-amp2/system-rhel8", "product_name": "Red Hat 3scale API Management Platform 2"}, {"cpe": "cpe:/a:redhat:3scale:2.13", "fix_state": "Fix deferred", "package_name": "3scale-amp2/system-rhel9", "product_name": "Red Hat 3scale API Management Platform 2"}, {"cpe": "cpe:/a:redhat:3scale:2.13", "fix_state": "Fix deferred", "package_name": "3scale-amp2/zync-rhel9", "product_name": "Red Hat 3scale API Management Platform 2"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Fix deferred", "package_name": "rubygem-actionpack", "product_name": "Red Hat Satellite 6"}], "public_date": "2026-11-10T20:46:43Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-126073\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-126073\nhttps://github.com/rails/rails/commit/7a955ca36779938267c93902c47d1f55bab99b4b\nhttps://github.com/rails/rails/commit/b58c107abe9c1f10c1d6a4941402c60e4dc4742c\nhttps://github.com/rails/rails/releases/tag/v8.0.5.2\nhttps://github.com/rails/rails/releases/tag/v8.1.4.1\nhttps://github.com/rails/rails/security/advisories/GHSA-r9jg-fmfx-2gv6"], "statement": "This vulnerability is rated as Moderate impact because successful exploitation requires specific deployment prerequisites\u2014namely, fronting the application with a shared caching proxy while serving public responses that rely on content negotiation\u2014and does not allow an attacker to inject arbitrary content. Under default configurations, typical Red Hat deployments do not expose publicly cacheable, content-negotiated endpoints to shared intermediate caches without explicit application design. Because an attacker cannot control the cached data beyond inducing the proxy to serve an unintended valid representation to subsequent clients, the blast radius is restricted to minor presentation discrepancies or temporary format mismatches.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[8.1,8.1.4.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,8.0.5.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "rails", "source": "cna", "vendor": "rails"}, "product": "rails", "vendor": "rails"}], "created": "2026-11-12T01:00:09.864421+00:00", "updated": "2026-11-13T11:45:20.060720+00:00", "vendors": ["rails", "rails$PRODUCT$rails"]}