CVE-2026-126076

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-126076", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-11-10T17:07:43.285Z", "datePublished": "2026-11-10T20:57:07.582Z", "dateUpdated": "2026-11-12T19:05:13.367Z"}, "containers": {"cna": {"title": "Action Pack: Possible restoration of destroyed sessions in Action Dispatch CacheStore", "problemTypes": [{"descriptions": [{"cweId": "CWE-613", "lang": "en", "description": "CWE-613: Insufficient Session Expiration", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/rails/rails/security/advisories/GHSA-2586-8ghr-69fj", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/rails/rails/security/advisories/GHSA-2586-8ghr-69fj"}, {"name": "https://github.com/rails/rails/commit/5bb5ec66ed8faaf590ffe1222d7a5eb6e9d050f5", "tags": ["x_refsource_MISC"], "url": "https://github.com/rails/rails/commit/5bb5ec66ed8faaf590ffe1222d7a5eb6e9d050f5"}, {"name": "https://github.com/rails/rails/commit/d479192cf88a8b30a335a8bc25188a2d8e0f8d9f", "tags": ["x_refsource_MISC"], "url": "https://github.com/rails/rails/commit/d479192cf88a8b30a335a8bc25188a2d8e0f8d9f"}, {"name": "https://github.com/rails/rails/releases/tag/v8.0.5.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/rails/rails/releases/tag/v8.0.5.2"}, {"name": "https://github.com/rails/rails/releases/tag/v8.1.4.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/rails/rails/releases/tag/v8.1.4.1"}], "affected": [{"vendor": "rails", "product": "rails", "versions": [{"version": ">= 8.1, < 8.1.4.1", "status": "affected"}, {"version": "< 8.0.5.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-10T20:57:07.582Z"}, "descriptions": [{"lang": "en", "value": "Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, ActionDispatch::Session::CacheStore writes a session back to the cache at the end of each request that loaded it, without checking that the session's cache entry still exists. When a concurrent request destroys the session, through reset_session on logout or by deleting its cache entry on the server, a request that loaded the session earlier and finishes later restores it under its original session ID. Logout and server-side revocation could therefore fail to end a session, and an attacker who holds a stolen session cookie could keep that session valid across the victim's logout. Applications that use config.session_store :cache_store are affected, with any cache backend. ActionDispatch::Session::CookieStore is not affected, nor is ActionDispatch::Session::MemCacheStore with Dalli 4.0.0 or later, whose session store does not write back a session that was deleted. This issue is fixed in versions 8.1.4.1 and 8.0.5.2."}], "source": {"advisory": "GHSA-2586-8ghr-69fj", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-12T19:04:57.165186Z", "id": "CVE-2026-126076", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-12T19:05:13.367Z"}}]}}

{}

{"affected": [{"affectedData": [{"product": "rails", "vendor": "rails", "versions": [{"status": "affected", "version": ">= 8.1, < 8.1.4.1"}, {"status": "affected", "version": "< 8.0.5.2"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, ActionDispatch::Session::CacheStore writes a session back to the cache at the end of each request that loaded it, without checking that the session's cache entry still exists. When a concurrent request destroys the session, through reset_session on logout or by deleting its cache entry on the server, a request that loaded the session earlier and finishes later restores it under its original session ID. Logout and server-side revocation could therefore fail to end a session, and an attacker who holds a stolen session cookie could keep that session valid across the victim's logout. Applications that use config.session_store :cache_store are affected, with any cache backend. ActionDispatch::Session::CookieStore is not affected, nor is ActionDispatch::Session::MemCacheStore with Dalli 4.0.0 or later, whose session store does not write back a session that was deleted. This issue is fixed in versions 8.1.4.1 and 8.0.5.2."}], "id": "CVE-2026-126076", "lastModified": "2026-11-12T22:09:39.233", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-126076", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-12T19:04:57.165186Z", "version": "2.0.3"}}]}, "published": "2026-11-10T21:19:26.040", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/rails/rails/commit/5bb5ec66ed8faaf590ffe1222d7a5eb6e9d050f5"}, {"source": "security-advisories@github.com", "url": "https://github.com/rails/rails/commit/d479192cf88a8b30a335a8bc25188a2d8e0f8d9f"}, {"source": "security-advisories@github.com", "url": "https://github.com/rails/rails/releases/tag/v8.0.5.2"}, {"source": "security-advisories@github.com", "url": "https://github.com/rails/rails/releases/tag/v8.1.4.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/rails/rails/security/advisories/GHSA-2586-8ghr-69fj"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-613"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "actionpack: actionpack: Session retention across logout via race condition in CacheStore", "id": "2571272", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2571272"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.2", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-613", "details": ["A flaw was found in actionpack. During concurrent web requests, the session cache store writes session data back to the cache without verifying whether the session has already been invalidated or deleted. A remote attacker possessing a stolen session identifier could exploit this race condition to keep the session active and maintain unauthorized access even after the legitimate user logs out."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-126076", "package_state": [{"cpe": "cpe:/a:redhat:3scale:2.13", "fix_state": "Out of support scope", "package_name": "3scale-amp2/system-rhel8", "product_name": "Red Hat 3scale API Management Platform 2"}, {"cpe": "cpe:/a:redhat:3scale:2.13", "fix_state": "Fix deferred", "package_name": "3scale-amp2/system-rhel9", "product_name": "Red Hat 3scale API Management Platform 2"}, {"cpe": "cpe:/a:redhat:3scale:2.13", "fix_state": "Fix deferred", "package_name": "3scale-amp2/zync-rhel9", "product_name": "Red Hat 3scale API Management Platform 2"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Fix deferred", "package_name": "rubygem-actionpack", "product_name": "Red Hat Satellite 6"}], "public_date": "2026-11-10T20:57:07Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-126076\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-126076\nhttps://github.com/rails/rails/commit/5bb5ec66ed8faaf590ffe1222d7a5eb6e9d050f5\nhttps://github.com/rails/rails/commit/d479192cf88a8b30a335a8bc25188a2d8e0f8d9f\nhttps://github.com/rails/rails/releases/tag/v8.0.5.2\nhttps://github.com/rails/rails/releases/tag/v8.1.4.1\nhttps://github.com/rails/rails/security/advisories/GHSA-2586-8ghr-69fj"], "statement": "This vulnerability is evaluated with a Moderate impact for Red Hat products because exploitation depends on an attacker already possessing an active session token and winning a tight timing window during session termination. Applications using the default cookie-based session mechanism are unaffected, as the defect only surfaces when web services are specifically configured to use external cache stores for session persistence. Furthermore, the risk is limited to preserving existing session privileges across logout rather than allowing arbitrary authentication bypass.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[8.1,8.1.4.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,8.0.5.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "rails", "source": "cna", "vendor": "rails"}, "product": "rails", "vendor": "rails"}], "created": "2026-11-12T01:00:09.864145+00:00", "updated": "2026-11-13T11:45:20.059662+00:00", "vendors": ["rails", "rails$PRODUCT$rails"]}