UBUNTU-CVE-2026-126067: Medium severity ubuntu/rails vulnerability
Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, Action Pack session stores other than ActionDispatch::Session::CookieStore (CacheStore, MemCacheStore, and third-party stores built on AbstractStore, AbstractSecureStore or the session mixins) write the session cookie without a SameSite attribute, regardless of config.actiondispatch.cookiessamesiteprotection, which defaults to :lax. Only CookieStore applies the configured policy. In browsers that do not treat a cookie without the attribute as SameSite=Lax, a cross-site request could carry the session cookie, possibly leading to cross-site request forgery against actions that do not verify an authenticity token, such as those of API-only applications. Applications are affected when they use a session store other than CookieStore and do not pass samesite: to config.sessionstore. This issue is fixed in versions 8.1.4.1 and 8.0.5.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.1.4.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.0.5.2
Event History
Frequently Asked Questions
Which applications are affected?
Applications are affected when they use a session store other than ActionDispatch::Session::CookieStore and do not explicitly pass same_site: to config.session_store. This includes CacheStore, MemCacheStore, and third-party stores built on AbstractStore, AbstractSecureStore, or the session mixins.
What must an attacker rely on to exploit this?
The attack requires a browser that does not treat cookies lacking a SameSite attribute as SameSite=Lax. A cross-site request must also target an action that does not verify an authenticity token, which can include API-only application actions.
Is the default SameSite configuration sufficient protection?
No. Although config.action_dispatch.cookies_same_site_protection defaults to :lax, affected non-CookieStore session stores write the session cookie without a SameSite attribute and do not apply that configured policy.
What can be done before upgrading?
Explicitly pass same_site: to config.session_store for the application's session store. Also ensure actions that use session authentication verify an authenticity token where applicable.
Which versions contain the fix?
The issue is fixed in Action Pack versions 8.1.4.1 and 8.0.5.2.