CVE-2026-126081: Strong Parameters Bypass via Parameters#each_key in Ruby on Rails Action Pack

Vulnerability ID: CVE-2026-126081
CVSS Score: 7.5
Published: 2026-11-12

CVE-2026-126081 is a mass-assignment vulnerability (CWE-915) in the Action Pack component of Ruby on Rails. Prior to versions 8.1.4.1 and 8.0.5.2, the ActionController::Parameters#each_key method was delegated directly to the internal ActiveSupport::HashWithIndifferentAccess instance holding raw request parameters. When invoked with a block, #each_key returned the underlying unpermitted hash rather than the ActionController::Parameters wrapper instance. Applications that pass the return value of #each_key directly into Active Model mass-assignment methods bypass Strong Parameters enforcement, allowing attackers to modify restricted model attributes.

TL;DR

ActionController::Parameters#each_key returns the internal unpermitted HashWithIndifferentAccess object instead of the Parameters wrapper when called with a block. Passing this return value to Active Model update or creation methods bypasses Strong Parameters checks. Upgrade to Rails 8.1.4.1 or 8.0.5.2 to resolve the issue.

Technical Details

• CVE ID: CVE-2026-126081 (GHSA-wm3x-v3qw-4jh3)
• Weakness Class: CWE-915 (Mass Assignment / Improperly Controlled Object Attributes)
• CVSS v3.1 Score: 7.5 HIGH (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
• EPSS Score: 0.63% (50.49th Percentile)
• Affected Component: actionpack (ActionController::Parameters#each_key)
• Security Impact: Strong Parameters Bypass / Unauthorized Attribute Modification
• Exploit Status: No Known Public Exploits
• CISA KEV Status: Not Listed

Affected Systems

• Ruby on Rails (rails gem)
• Action Pack (actionpack gem)
• actionpack: >= 8.1, < 8.1.4.1 (Fixed in: 8.1.4.1)
• actionpack: < 8.0.5.2 (Fixed in: 8.0.5.2)

Code Analysis

Commit: 8ba746e

Return self from Parameters#each_key with a block GHSA-wm3x-v3qw-4jh3

@@ -248,7 +247,7 @@ class Parameters
     # Returns the content of the parameters as a string.

     delegate :keys, :empty?, :exclude?, :include?,
-      :as_json, :to_s, :each_key, to: :@parameters
+      :as_json, :to_s, to: :@parameters

     alias_method :has_key?, :include?
     alias_method :key?, :include?
@@ -420,6 +419,15 @@ def each_value(&block)
       self
     end

+    # Calls block once for each key in the parameters, passing the key. If no block
+    # is given, an enumerator is returned instead.
+    def each_key(&block)
+      return to_enum(:each_key) unless block_given?
+      @parameters.each_key(&block)
+
+      self
+    end

Commit: 2fc8838

Return self from Parameters#each_key with a block GHSA-wm3x-v3qw-4jh3

@@ -248,7 +247,7 @@ class Parameters
     # Returns the content of the parameters as a string.

     delegate :keys, :empty?, :exclude?, :include?,
-      :as_json, :to_s, :each_key, to: :@parameters
+      :as_json, :to_s, to: :@parameters

     alias_method :has_key?, :include?
     alias_method :key?, :include?
@@ -420,6 +419,15 @@ def each_value(&block)
       self
     end

+    # Calls block once for each key in the parameters, passing the key. If no block
+    # is given, an enumerator is returned instead.
+    def each_key(&block)
+      return to_enum(:each_key) unless block_given?
+      @parameters.each_key(&block)
+
+      self
+    end

Mitigation Strategies

• Upgrade Ruby on Rails and the actionpack gem to versions 8.1.4.1 or 8.0.5.2 immediately.
• Audit application controllers and parameter handling services for any usage of #each_key or #as_json on ActionController::Parameters instances.
• Enforce strict Strong Parameters usage patterns via static analysis (e.g., Brakeman or RuboCop) by requiring all model mass-assignment inputs to flow through dedicated private *_params methods using .permit().

Remediation Steps:

1. Update the Gemfile to require rails >= 8.1.4.1 (for 8.1.x apps) or >= 8.0.5.2 (for 8.0.x apps).
2. Execute 'bundle update rails actionpack' and verify the updated version in Gemfile.lock.
3. Run the application test suite to confirm that any unintentional reliance on #each_key returning an unpermitted hash now appropriately raises ActiveModel::ForbiddenAttributesError.
4. Deploy the updated dependency bundle to all staging and production environments.

References

• GitHub Security Advisory: GHSA-wm3x-v3qw-4jh3
• CVE-2026-126081 Official CVE Record
• NVD Vulnerability Detail: CVE-2026-126081
• Rails Patch Commit (8.1 branch): 8ba746e0a786458c281060823f2ccc5c5f6312ac
• Rails Patch Commit (8.0 branch): 2fc8838300133931e19eed3ea6cee76a7e83f19c
• Ruby on Rails v8.1.4.1 Release
• Ruby on Rails v8.0.5.2 Release
• CVE List V5 JSON Record for CVE-2026-126081

Read the full report for CVE-2026-126081 on our website for more details including interactive diagrams and full exploit analysis.