CVE-2026-126067: Action Pack: Missing SameSite attribute on session cookies from Action Pack session stores

Q: Which applications are affected?

Applications are affected if they use a session store other than ActionDispatch::Session::CookieStore and do not pass a same_site: option to config.session_store. This includes CacheStore, MemCacheStore, and third-party stores based on AbstractStore, AbstractSecureStore, or the session mixins.

Q: Does the default cookies_same_site_protection setting protect non-CookieStore session stores?

No. Although config.action_dispatch.cookies_same_site_protection defaults to :lax, the affected session stores write their session cookie without a SameSite attribute unless same_site: is explicitly configured.

Q: What conditions are required for exploitation?

The browser must send a cookie lacking a SameSite attribute on a cross-site request. An attacker could then target an action that does not verify an authenticity token, such as actions in API-only applications.

Q: What can be done before updating?

Explicitly pass same_site: when configuring config.session_store. Do not rely solely on cookies_same_site_protection for a non-CookieStore session store.

Q: How can I determine whether my application is exposed?

Inspect the configured session store and its config.session_store options. The application is in scope when the store is not CookieStore and there is no explicit same_site: option.

Published Nov 10, 2026

Updated

Impact Action Pack session stores other than ActionDispatch::Session::CookieStore (CacheStore, MemCacheStore, and third-party stores built on AbstractStore, AbstractSecureStore or the session mixins) write the session cookie without a SameSite attribute, regardless of config.actiondispatch.cookiessamesiteprotection, which defaults to :lax. Only CookieStore applies the configured policy. In browsers that do not treat a cookie without the attribute as SameSite=Lax, a cross-site request could carry the session cookie, possibly leading to cross-site request forgery against actions that do not verify an authenticity token, such as those of API-only applications.

Applications are affected when they use a session store other than CookieStore and do not pass samesite: to config.sessionstore.

Details In the fixed releases, every session store sets the session cookie's SameSite attribute from cookiessamesiteprotection when its options have no :samesite key. An explicit samesite: option, including samesite: nil, and a :samesite value in a store's DEFAULTOPTIONS still take precedence.

Workarounds Pass samesite: when configuring the session store, for example config.sessionstore :cachestore, samesite: :lax.

Releases The fixed releases are available at the normal locations.

Patches for those who cannot upgrade at once: - 8.1: https://github.com/rails/rails/commit/2d9f502df941e31ce9bad0e846564f49396bed46.patch - 8.0: https://github.com/rails/rails/commit/f2392996be723708271a8d30bfcf0edc221e53ef.patch

Credit This issue was responsibly reported by HackerOne researcher tjvc.

Other sources

Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, Action Pack session stores other than ActionDispatch::Session::CookieStore (CacheStore, MemCacheStore, and third-party stores built on AbstractStore, AbstractSecureStore or the session mixins) write the session cookie without a SameSite attribute, regardless of config.actiondispatch.cookiessamesiteprotection, which defaults to :lax. Only CookieStore applies the configured policy. In browsers that do not treat a cookie without the attribute as SameSite=Lax, a cross-site request could carry the session cookie, possibly leading to cross-site request forgery against actions that do not verify an authenticity token, such as those of API-only applications. Applications are affected when they use a session store other than CookieStore and do not pass samesite: to config.sessionstore. This issue is fixed in versions 8.1.4.1 and 8.0.5.2.

— MITRE

Affected Software

2 affected componentsFixes available

rubygems/actionpack<8.0.5.2

8.0.5.2

rubygems/actionpack>=8.1.0.beta1<8.1.4.1

8.1.4.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade rubygems/actionpack to a version that resolves this vulnerability.
Fixed in 8.0.5.2
Upgrade
Upgrade rubygems/actionpack to a version that resolves this vulnerability.
Fixed in 8.1.4.1
Upgrade
Upgrade rails/action-pack to a version that resolves this vulnerability.
Fixed in 8.1.4.1
Upgrade
Upgrade rails/action-pack to a version that resolves this vulnerability.
Fixed in 8.0.5.2
Configuration
Pass same_site: :lax when configuring a session store, for example config.session_store :cache_store, same_site: :lax.
Action Pack session store same_site = :lax

Event History

Nov 10, 2026

CVE Published

via MITRE·08:29 PM

Data Sourced

via MITRE·08:29 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:19 PM

DescriptionSeverityWeakness

Advisory Published

via GitHub·09:25 PM

Data Sourced

via GitHub·09:25 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Which applications are affected?

Applications are affected if they use a session store other than ActionDispatch::Session::CookieStore and do not pass a same_site: option to config.session_store. This includes CacheStore, MemCacheStore, and third-party stores based on AbstractStore, AbstractSecureStore, or the session mixins.

Does the default cookies_same_site_protection setting protect non-CookieStore session stores?

No. Although config.action_dispatch.cookies_same_site_protection defaults to :lax, the affected session stores write their session cookie without a SameSite attribute unless same_site: is explicitly configured.

What conditions are required for exploitation?

The browser must send a cookie lacking a SameSite attribute on a cross-site request. An attacker could then target an action that does not verify an authenticity token, such as actions in API-only applications.

What can be done before updating?

Explicitly pass same_site: when configuring config.session_store. Do not rely solely on cookies_same_site_protection for a non-CookieStore session store.

How can I determine whether my application is exposed?

Inspect the configured session store and its config.session_store options. The application is in scope when the store is not CookieStore and there is no explicit same_site: option.

CVE-2026-126067: Action Pack: Missing SameSite attribute on session cookies from Action Pack session stores

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

Which applications are affected?

Does the default cookies_same_site_protection setting protect non-CookieStore session stores?

What conditions are required for exploitation?

What can be done before updating?

How can I determine whether my application is exposed?

Company

Resources

Contact

Frequently Asked Questions

Which applications are affected?

Does the default cookies_same_site_protection setting protect non-CookieStore session stores?

What conditions are required for exploitation?

What can be done before updating?

How can I determine whether my application is exposed?