{"id":"CVE-2026-126067","aliases":["GHSA-gmj8-hvj3-49mw"],"url":"https://o3.security/vulnerability/CVE-2026-126067","summary":"Action Pack: Missing SameSite attribute on session cookies from Action Pack session stores","details":"### Impact\nAction Pack session stores other than `ActionDispatch::Session::CookieStore` (`CacheStore`, `MemCacheStore`, and third-party stores built on `AbstractStore`, `AbstractSecureStore` or the session mixins) write the session cookie without a `SameSite` attribute, regardless of `config.action_dispatch.cookies_same_site_protection`, which defaults to `:lax`. Only `CookieStore` applies the configured policy. In browsers that do not treat a cookie without the attribute as `SameSite=Lax`, a cross-site request could carry the session cookie, possibly leading to cross-site request forgery against actions that do not verify an authenticity token, such as those of API-only applications.\n\nApplications are affected when they use a session store other than `CookieStore` and do not pass `same_site:` to `config.session_store`.\n\n### Details\nIn the fixed releases, every session store sets the session cookie's `SameSite` attribute from `cookies_same_site_protection` when its options have no `:same_site` key. An explicit `same_site:` option, including `same_site: nil`, and a `:same_site` value in a store's `DEFAULT_OPTIONS` still take precedence.\n\n### Workarounds\nPass `same_site:` when configuring the session store, for example `config.session_store :cache_store, same_site: :lax`.\n\n### Releases\nThe fixed releases are available at the normal locations.\n\nPatches for those who cannot upgrade at once:\n- 8.1: https://github.com/rails/rails/commit/2d9f502df941e31ce9bad0e846564f49396bed46.patch\n- 8.0: https://github.com/rails/rails/commit/f2392996be723708271a8d30bfcf0edc221e53ef.patch\n\n### Credit\nThis issue was responsibly reported by HackerOne researcher [tjvc](https://hackerone.com/tjvc).","published":"2026-11-10T20:29:44.430Z","modified":"2026-11-11T10:47:26.560571180Z","cvss":{"score":3.1,"severity":"LOW","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"RubyGems","name":"actionpack","fixedVersion":"8.1.4.1"},{"ecosystem":"RubyGems","name":"actionpack","fixedVersion":"8.0.5.2"}],"fix":{"url":"https://github.com/rails/rails/commit/2d9f502df941e31ce9bad0e846564f49396bed46","label":"rails/rails@2d9f502"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126067.json"},{"type":"FIX","url":"https://github.com/rails/rails/commit/2d9f502df941e31ce9bad0e846564f49396bed46"},{"type":"FIX","url":"https://github.com/rails/rails/commit/f2392996be723708271a8d30bfcf0edc221e53ef"},{"type":"WEB","url":"https://github.com/rails/rails/releases/tag/v8.0.5.2"},{"type":"WEB","url":"https://github.com/rails/rails/releases/tag/v8.1.4.1"},{"type":"ADVISORY","url":"https://github.com/rails/rails/security/advisories/GHSA-gmj8-hvj3-49mw"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126067"},{"type":"PACKAGE","url":"https://github.com/rails/rails"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/GHSA-gmj8-hvj3-49mw.yml"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-11-11T10:47:26.560571180Z"}}