---
id: "CVE-2026-126076"
page: "https://infrastack.ai/live/CVE-2026-126076"
kind: "vulnerability"
aliases: ["CVE-2026-126076", "GHSA-2586-8ghr-69fj"]
title: "Action Pack: Possible restoration of destroyed sessions in Action Dispatch CacheStore"
severity: "medium"
cvss: 4.2
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "actionpack", "fixed": ["8.1.4.1"], "affected": ">= 8.1, < 8.1.4.1", "ecosystem": "rubygems"}, {"name": "actionpack", "fixed": ["8.0.5.2"], "affected": "< 8.0.5.2", "ecosystem": "rubygems"}, {"name": "actionpack", "fixed": ["8.1.4.1"], "affected": ">= 8.1.0.beta1, < 8.1.4.1", "ecosystem": "rubygems"}]
ecosystems: ["rubygems"]
tags: ["cache-store-sessions", "cwe-613", "package", "rails", "ruby", "self-hosted"]
not_affected_if: ["cookie-store", "memcache-store-dalli-4", "no-session-revocation"]
published_at: "2026-11-04T03:01:46+00:00"
first_seen_at: "2026-11-10T21:01:34+00:00"
updated_at: "2026-11-10T21:23:01+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/rails/rails/security/advisories/GHSA-2586-8ghr-69fj", "first_seen_at": "2026-11-10T21:01:34+00:00"}, {"source": "ghsa", "url": "https://github.com/advisories/GHSA-2586-8ghr-69fj", "first_seen_at": "2026-11-10T21:23:01+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126076", "first_seen_at": "2026-11-10T21:46:15+00:00"}]
exploit_sources: []
---

# Action Pack: Possible restoration of destroyed sessions in Action Dispatch CacheStore

Link for people: https://infrastack.ai/live/CVE-2026-126076 (this .md is for agents)

Rails' ActionDispatch CacheStore session store writes a session back to the cache after a concurrent logout or server-side deletion, so the destroyed session comes back under its original ID. An attacker holding a stolen session cookie can keep that session valid after the victim logs out.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- rubygems:actionpack affected >= 8.1, < 8.1.4.1 fixed 8.1.4.1
- rubygems:actionpack affected < 8.0.5.2 fixed 8.0.5.2
- rubygems:actionpack affected >= 8.1.0.beta1, < 8.1.4.1 fixed 8.1.4.1

## How to check

- Check the Rails version in `Gemfile.lock` for `actionpack`.
- Look for `config.session_store :cache_store` in `config/initializers` or `config/application.rb`; CookieStore is not affected.
- Check whether the app's Dalli version is `4.0.0` or later if it uses MemCacheStore; that store is not affected.

## Fix

- `actionpack` `8.1.4.1` for the 8.1 line.
- `actionpack` `8.0.5.2` for the 8.0 line.
- Patch files for teams that cannot upgrade at once are linked in the advisory.

## Timeline

- 2026-11-10T21:01:34+00:00 ghsa-repo https://github.com/rails/rails/security/advisories/GHSA-2586-8ghr-69fj
- 2026-11-10T21:23:01+00:00 ghsa https://github.com/advisories/GHSA-2586-8ghr-69fj
- 2026-11-10T21:46:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126076

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/rails/rails/security/advisories/GHSA-2586-8ghr-69fj
- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/rails/rails/security-advisories/GHSA-2586-8ghr-69fj
- [fix] Patch: github.com https://github.com/rails/rails/commit/5bb5ec66ed8faaf590ffe1222d7a5eb6e9d050f5
- [fix] Patch: github.com https://github.com/rails/rails/commit/d479192cf88a8b30a335a8bc25188a2d8e0f8d9f
- [fix] Release notes: github.com https://github.com/rails/rails/releases/tag/v8.0.5.2
- [fix] Release notes: github.com https://github.com/rails/rails/releases/tag/v8.1.4.1

## From the sources

### Impact
`ActionDispatch::Session::CacheStore` writes a session back to the cache at the end of each request that loaded it, without checking that the session's cache entry still exists. When a concurrent request destroys the session, through `reset_session` on logout or by deleting its cache entry on the server, a request that loaded the session earlier and finishes later restores it under its original session ID. Logout and server-side revocation could therefore fail to end a session, and an attacker who holds a stolen session cookie could keep that session valid across the victim's logout.

Applications that use `config.session_store :cache_store` are affected, with any cache backend. `ActionDispatch::Session::CookieStore` is not affected, nor is `ActionDispatch::Session::MemCacheStore` with Dalli 4.0.0 or later, whose session store does not write back a session that was deleted.

### Details
The fixed releases record which session a request loaded and skip the write when that session's cache entry no longer exists. Changes that such a request makes to the destroyed session are discarded, and Rack logs a warning that the session could not be saved. Each request that writes back a session it loaded makes one additional cache read.

### Releases
The fixed releases are available at the normal locations.

Patches for those who cannot upgrade at once:
- 8.1: https://github.com/rails/rails/commit/d479192cf88a8b30a335a8bc25188a2d8e0f8d9f.patch
- 8.0: https://github.com/rails/rails/commit/5bb5ec66ed8faaf590ffe1222d7a5eb6e9d050f5.patch

### Credit
Found by the team during internal code review.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_