Cpe:2.3:a:ruby_on_rails:action_pack:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3aruby_on_railsaction_pack/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 13 Nov 2026 04:57:41 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAction Pack: Parameters#each_key mass assignment bypass (CVE-2026-126081)https://feed.craftedsignal.io/briefs/2026-11-actionpack-parameters-bypass-ghsa-wm3x-v3qw-4jh3/Fri, 13 Nov 2026 04:57:41 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-actionpack-parameters-bypass-ghsa-wm3x-v3qw-4jh3/The Action Pack component in Ruby on Rails incorrectly handles the return value of the each_key method, which may allow attackers to bypass Active Model mass assignment protections.Ruby on Rails' Action Pack component contains a vulnerability in ActionController::Parameters#each_key where the method returns the internal ActiveSupport::HashWithIndifferentAccess hash instead of the Parameters instance when invoked with a block. Because this returned hash lacks the permitted? method, it is not rejected by Active Model mass assignment mechanisms.

Impact

An application that passes the return value of each_key to mass assignment (such as new, assign_attributes, or update) could allow a remote, unauthenticated attacker to set attributes that the application does not permit, such as an authorization flag.

Recommendation

Developers should avoid using the return value of each_key and ensure only permitted Parameters instances are provided to mass assignment methods.

]]>highadvisory