UBUNTU-CVE-2026-126081: Medium severity ubuntu/rails vulnerability
Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, ActionController::Parameters#eachkey delegates to the internal ActiveSupport::HashWithIndifferentAccess that holds the request parameters, so when called with a block it returns that hash instead of the Parameters instance. The hash does not respond to permitted?, so Active Model mass assignment (new, assignattributes, update) accepts it without raising ActiveModel::ForbiddenAttributesError. An application that passes the return value of eachkey to mass assignment could allow a remote, unauthenticated attacker to set attributes that the application does not permit, such as an authorization flag. This is an incomplete fix of CVE-2020-8164, which made each, eachpair and eachvalue return the Parameters instance but left eachkey delegated. An application is affected if it passes the return value of ActionController::Parameters#eachkey, called with a block, to mass assignment. Rails itself makes no such call. This issue is fixed in versions 8.1.4.1 and 8.0.5.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Action Packto a version that resolves this vulnerability.Fixed in 8.1.4.1 - Upgrade
Upgrade
Action Packto a version that resolves this vulnerability.Fixed in 8.0.5.2
Event History
Frequently Asked Questions
Are default Rails applications affected?
Rails itself does not make the affected call. An application is affected only if it passes the return value of ActionController::Parameters#each_key, when each_key is called with a block, into mass-assignment methods such as new, assign_attributes, or update.
What does an attacker need to exploit this issue?
Exploitation can be remote and unauthenticated if the application has the affected parameter-handling pattern. The attacker must be able to supply request parameters that reach the vulnerable mass-assignment path, potentially allowing assignment of attributes the application did not permit.
How can I determine whether my application is affected?
Review application code for ActionController::Parameters#each_key calls that use a block, then determine whether the returned value is passed to new, assign_attributes, or update. Calls to each_key without this mass-assignment flow are not identified as affected by the advisory.
What remediation is available?
Upgrade to Rails 8.1.4.1 or 8.0.5.2. If upgrading cannot happen immediately, remove or refactor the affected flow so the return value of each_key called with a block is not passed to mass assignment.