Action Pack: IP spoofing in ActionDispatch::RemoteIp (CVE-2026-126083)

A vulnerability in ActionDispatch::RemoteIp (CVE-2026-126083) allows unauthenticated attackers to bypass IP-based security controls by spoofing the client IP address. The vulnerability arises because Rails 8.1.0 and later, when running on Rack 3, defaults to reading the RFC 7239 'Forwarded' header. If a reverse proxy passes a client-supplied 'Forwarded' header while simultaneously appending the actual client address to the 'X-Forwarded-For' header, the application incorrectly trusts the 'Forwarded' header, allowing an attacker to choose their perceived 'remote_ip'.

Impact

Successful exploitation may allow attackers to bypass IP-based access control lists (ACLs) and rate limits, and leads to incorrect client identification in application logs.

Recommendation

• Upgrade to Action Pack 8.1.4.1 or later immediately.
• If upgrading is not immediately possible, configure reverse proxies to explicitly remove or overwrite the 'Forwarded' header before the request reaches the Rails application.
• Alternatively, set 'Rack::Request.forwarded_priority = [:x_forwarded]' in an initializer to force Rack to ignore the 'Forwarded' header.
• Audit logs for instances of 'ActionDispatch::RemoteIp::IpSpoofAttackError' following the deployment of the patch, as these may indicate blocked spoofing attempts.