What is CVE-2026-126067?

CVE-2026-126067 is a low-severity vulnerability in Rails, classified under Cross-Site Request Forgery (CSRF). CVSS score: 3.1/10. Published 2026-11-10.

How severe is CVE-2026-126067?

Low severity. CVSS v3 base score is 3.1 out of 10.

CSRF in Rails

CVE-2026-126067

Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, Action Pack session stores other than ActionDispatch::Session::CookieStore (CacheStore, MemCacheStore, and third-party stores built on AbstractStore, AbstractSecureStore or the session mixins) write the session cookie without a SameSite attribute, regardless of config.action_dispatch.cookies_same_site_protection, which defaults to :lax. Only CookieStore applies the configured policy. In browsers that do not treat a cookie without the attribute as SameSite=Lax, a cross-site request could carry the session cookie, possibly leading to cross-site request forgery against actions that do not verify an authenticity token, such as those of API-only applications. Applications are affected when they use a session store other than CookieStore and do not pass same_site: to config.session_store. This issue is fixed in versions 8.1.4.1 and 8.0.5.2.

Vulnerability class: CSRF (Cross-Site Request Forgery)

Published 2026-11-10.

CVSS v3 metric

CVSS v3 base score 3.1 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Rails — versions < 8.0.5.2, >= 8.1, < 8.1.4.1

Weakness classification (CWE)

CWE-352 — Cross-Site Request Forgery (CSRF)

References

Frequently asked questions

What is CVE-2026-126067?: CVE-2026-126067 is a low-severity vulnerability in Rails, classified under Cross-Site Request Forgery (CSRF). CVSS score: 3.1/10. Published 2026-11-10.
How severe is CVE-2026-126067?: Low severity. CVSS v3 base score is 3.1 out of 10.