Action Pack: Possible IP spoofing in Action Dispatch RemoteIp
CVE-2026-126083
Impact Since Rails 8.1.0, ActionDispatch::RemoteIp derives request.remoteip from Rack::Request#forwardedfor, which under Rack 3 reads the RFC 7239 Forwarded header in preference to X-Forwarded-For. When a reverse proxy appends the client address to X-Forwarded-For but passes a client-supplied Forwarded header through unchanged, request.remoteip returns an address chosen by the client, and the IP spoofing check does not raise, because it compares only Client-Ip with the forwarded addresses. An unauthenticated attacker could therefore spoof request.remoteip, possibly bypassing IP-based access controls and rate limits keyed on the client address (including the default by: of ratelimit), and falsifying the client address in logs. Details The 8.1.0 change ([2d084af8](https://github.com/rails/rails/commit/2d084af8444a7b6b868c7cbb256172007871e78d)) switched ActionDispatch::RemoteIp from reading X-Forwarded-For directly to Rack's forwardedfor, in order to reuse Rack's port handling. Rails continues to honor Forwarded, the standard header. In the fixed releases, when config.actiondispatch.ipspoofingcheck is enabled (the default), ActionDispatch::RemoteIp also compares the first untrusted…
Assessment
- CVSS
- 7.4 (v3.1)
- Severity
- High
- EPSS
- 0.00357% chance of exploitation in the next 30 days
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 10 November 2026
- Last updated
- 10 November 2026
- Affected
- actionpack
- Weakness
- CWE-348
CVSS vectorCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
At the source
References
- https://github.com/rails/rails/security/advisories/GHSA-2gff-2mmg-m73p
- https://github.com/rails/rails/commit/2a01a5ac521184419d9a92fa2c25e102e68cd227
- https://github.com/rails/rails/releases/tag/v8.1.4.1
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/GHSA-2gff-2mmg-m73p.yml
- https://github.com/advisories/GHSA-2gff-2mmg-m73p
Community proofs of concept
No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.
Submit a proof of concept
Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-126083