Action Pack: Parameters#each_key mass assignment bypass (CVE-2026-126081)
The Action Pack component in Ruby on Rails incorrectly handles the return value of the each_key method, which may allow attackers to bypass Active Model mass assignment protections.
CVE search metadata
CVE search record: CVE-2026-126081. Severity: high. CVSS: 7.5. EPSS: 0.62%. KEV: no. Product: Action Pack (< 8.1.4.1, < 8.0.5.2). Brief: Action Pack: Parameters#each_key mass assignment bypass (CVE-2026-126081). Brief link: https://feed.craftedsignal.io/briefs/2026-11-actionpack-parameters-bypass-ghsa-wm3x-v3qw-4jh3/
Triage facts
Revision 1- Applicability
- Action Pack (< 8.1.4.1, < 8.0.5.2)
- Evidence
- Unknown
- Severity
- High
- Sources
- 4 public sources
- Freshness
- Revision 1Nov 13, 04:57 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- B2Roughly even chance
Ruby on Rails' Action Pack component contains a vulnerability in ActionController::Parameters#each_key where the method returns the internal ActiveSupport::HashWithIndifferentAccess hash instead of the Parameters instance when invoked with a block. Because this returned hash lacks the permitted? method, it is not rejected by Active Model mass assignment mechanisms.
Impact
An application that passes the return value of each_key to mass assignment (such as new, assign_attributes, or update) could allow a remote, unauthenticated attacker to set attributes that the application does not permit, such as an authorization flag.
Recommendation
Developers should avoid using the return value of each_key and ensure only permitted Parameters instances are provided to mass assignment methods.