Rails has possible Sensitive Session Information Leak in Active Storage

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

5.3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

• CVE-2024-26144: 1.12% estimated exploitation activity in the next 30 days; percentile 66.19 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Possible Sensitive Session Information Leak in Active Storage There is a possible sensitive session information leak in Active Storage. By default, Active Storage sends a Set-Cookie header along with the user's session cookie when serving blobs. It also sets Cache-Control to public. Certain proxies may cache the Set-Cookie, leading to an information leak. This vulnerability has been assigned the CVE identifier CVE-2024-26144. Versions Affected: = 5.2.0, < 7.1.0 Not affected: < 5.2.0, 7.1.0 Fixed Versions: 7.0.8.1, 6.1.7.7 Impact ------ A proxy which chooses to caches this request can cause users to share sessions. This may include a user receiving an attacker's session or vice versa. This was patched in 7.1.0 but not previously identified as a security vulnerability. All users running an affected release should either upgrade or use one of the workarounds immediately. Releases -------- The fixed releases are available at the normal locations. Workarounds ----------- Upgrade to Rails…

Published by the source

27 Feb 2024, 21:41 UTC

Last modified by the source

15 Mar 2026, 05:05 UTC

Source last checked

26 Oct 2026, 15:51 UTC

1. Revision 1 · created · 26 Oct 2026

   Published from ghsa record GHSA-8h22-8cf7-hq6g

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2024-26144

Advisory: Rails has possible Sensitive Session Information Leak in Active Storage
IDs: CVE-2024-26144, GHSA-8h22-8cf7-hq6g
Record: https://patchnext.com/advisories/cve-2024-26144 (revision 1, source checked 26 Oct 2026, 15:51 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Medium (CVSS 5.3)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: activestorage 7.0.8.1, 6.1.7.7. A vendor fix does not mean a deployment is fixed.

## Affected components
- RubyGems activestorage: affected >= 5.2.0, < 6.1.7.7; >= 7.0.0, < 7.0.8.1; fixed in 7.0.8.1, 6.1.7.7

## Suggested inspection (read-only)
- RubyGems activestorage: check the installed version with your package manager.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on activestorage.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-8h22-8cf7-hq6g (GitHub-reviewed advisory GHSA-8h22-8cf7-hq6g lists affected ranges: RubyGems activestorage >=5.2.0 =7.0.0 <7.0.8.1)

Commands are suggestions: review each one before running it.