UBUNTU-CVE-2026-126084: Medium severity ubuntu/rails vulnerability
Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.1.4.1 and 8.0.5.2, when a GCS service is configured with the cachecontrol option, ActiveStorage::Service::GCSService#urlfordirectupload signs direct-upload URLs with V4, and the V4 signature covers only the Cache-Control and Host headers. A direct-upload client can therefore send a Content-Type of its choosing, and can omit the declared Content-MD5, without invalidating the URL. GCS stores the supplied content type as object metadata, which takes precedence over the response-content-type that Active Storage sets on download URLs, so an uploaded object could be served as inline HTML under the application's bucket path on storage.googleapis.com. Script in such an object runs on the storage origin rather than the application's, but could register a Service Worker scoped to the bucket path and read or replace a victim's later responses for signed URLs in that bucket. Applications that use the GCS service with cachecontrol configured and accept direct uploads are affected. GCS services without cachecontrol sign with V2 and are not affected. This issue is fixed in versions 8.1.4.1 and 8.0.5.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Active Storageto a version that resolves this vulnerability.Fixed in 8.1.4.1 - Upgrade
Upgrade
Active Storageto a version that resolves this vulnerability.Fixed in 8.0.5.2
Event History
Frequently Asked Questions
Which deployments are affected?
Applications using Active Storage with a GCS service, with the cache_control option configured, and that accept direct uploads are affected. GCS services without cache_control use V2 signing and are not affected.
What does an attacker need to exploit this?
The attacker needs to act as a direct-upload client with a valid direct-upload URL. They can choose the uploaded object's Content-Type and omit the declared Content-MD5 without invalidating the V4-signed URL.
What is the practical impact of a malicious upload?
An attacker can cause an object to be stored with an inline HTML content type and served from the application's GCS bucket path. Script runs on the storage origin, but may register a Service Worker for that bucket path and read or replace later responses for signed URLs in the same bucket.
What mitigation is available if patching cannot happen immediately?
Avoid configuring cache_control on the affected GCS service, since GCS services without it use V2 signing and are not affected. This applies only where removing that option is operationally acceptable.