ACTIONPACK · CVE-2026-126076 · Package
FIX → 8.1.4.1 +1
Rails' ActionDispatch CacheStore session store writes a session back to the cache after a concurrent logout or server-side deletion, so the destroyed session comes back under its original ID. An attacker holding a stolen session cookie can keep that session valid after the victim logs out.
first public Nov 4, 2026 · 3 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that store sessions with Rails' cache store (config.session_store :cache_store) on any cache backend are exposed. Apps using the cookie store, or MemCacheStore with Dalli 4.0.0 or later, are not affected. Teams that rely on logout or server-side session revocation are the ones who need to act.
Not affected if cookie-store, memcache-store-dalli-4, no-session-revocation
Who cares cache-store-sessions, rails, ruby, self-hosted
Gemfile.lock for actionpack.config.session_store :cache_store in config/initializers or ; CookieStore is not affected.ActionDispatch::Session::CacheStore writes a session back to the cache at the end of each request that loaded it, without checking that the session's cache entry still exists. When a concurrent request destroys the session, through reset_session on logout or by deleting its cache entry on the server, a request that loaded the session earlier and finishes later restores it under its original session ID. Logout and server-side revocation could therefore fail to end a session, and an attacker who holds a stolen session cookie could keep that session valid across the victim's logout.
Applications that use config.session_store :cache_store are affected, with any cache backend. ActionDispatch::Session::CookieStore is not affected, nor is ActionDispatch::Session::MemCacheStore with Dalli 4.0.0 or later, whose session store does not write back a session that was deleted.
The fixed releases record which session a request loaded and skip the write when that session's cache entry no longer exists. Changes that such a request makes to the destroyed session are discarded, and Rack logs a warning that the session could not be saved. Each request that writes back a session it loaded makes one additional cache read.
The fixed releases are available at the normal locations.
Patches for those who cannot upgrade at once:
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
config/application.rb4.0.0 or later if it uses MemCacheStore; that store is not affected.Upgrade to 8.1.4.1 +1
actionpack 8.1.4.1 for the 8.1 line.actionpack 8.0.5.2 for the 8.0 line.Found by the team during internal code review.
This page as .md · .json · CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.