{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3arubyonrailsactionpack8.1.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:rubyonrails:actionpack:8.1.0:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.4,"id":"CVE-2026-126083"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["actionpack (\u003e= 8.1.0, \u003c 8.1.4.1)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Ruby on Rails"],"content_html":"\u003cp\u003eA vulnerability in ActionDispatch::RemoteIp (CVE-2026-126083) allows unauthenticated attackers to bypass IP-based security controls by spoofing the client IP address. The vulnerability arises because Rails 8.1.0 and later, when running on Rack 3, defaults to reading the RFC 7239 'Forwarded' header. If a reverse proxy passes a client-supplied 'Forwarded' header while simultaneously appending the actual client address to the 'X-Forwarded-For' header, the application incorrectly trusts the 'Forwarded' header, allowing an attacker to choose their perceived 'remote_ip'.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation may allow attackers to bypass IP-based access control lists (ACLs) and rate limits, and leads to incorrect client identification in application logs.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to Action Pack 8.1.4.1 or later immediately.\u003c/li\u003e\n\u003cli\u003eIf upgrading is not immediately possible, configure reverse proxies to explicitly remove or overwrite the 'Forwarded' header before the request reaches the Rails application.\u003c/li\u003e\n\u003cli\u003eAlternatively, set 'Rack::Request.forwarded_priority = [:x_forwarded]' in an initializer to force Rack to ignore the 'Forwarded' header.\u003c/li\u003e\n\u003cli\u003eAudit logs for instances of 'ActionDispatch::RemoteIp::IpSpoofAttackError' following the deployment of the patch, as these may indicate blocked spoofing attempts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-11T02:05:16Z","date_published":"2026-11-11T02:05:16Z","id":"https://feed.craftedsignal.io/briefs/2026-11-actionpack-ip-spoofing/","summary":"An unauthenticated attacker can spoof their remote IP address in Rails 8.1.0-8.1.4 by providing a malicious Forwarded header, potentially bypassing IP-based access controls and rate limiting.","title":"Action Pack: IP spoofing in ActionDispatch::RemoteIp (CVE-2026-126083)","url":"https://feed.craftedsignal.io/briefs/2026-11-actionpack-ip-spoofing/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:rubyonrails:actionpack:8.1.0:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}