Every CVE Search/ Get API key

CVE-2024-26144

Possible Sensitive Session Information Leak in Active Storage

5.3 MediumPublic exploitFix available

Rails is a web-application framework. Starting with version 5.2.0, there is a possible sensitive session information leak in Active Storage. By default, Active Storage sends a Set-Cookie header along with the user's session cookie when serving blobs. It also sets Cache-Control to public. Certain proxies may cache the Set-Cookie, leading to an information leak. The vulnerability is fixed in 7.0.8.1 and 6.1.7.7.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
None

Exploit likelihood

1.25%Up 1.2 points since Feb 28, 2024
90%50%10%1%

What each source reports

CVE List Score used 5.3

Possible Sensitive Session Information Leak in Active Storage

Rails is a web-application framework. Starting with version 5.2.0, there is a possible sensitive session information leak in Active Storage. By default, Active Storage sends a Set-Cookie header along with the user's session cookie when serving blobs. It also sets Cache-Control to public. Certain proxies may cache the Set-Cookie, leading to an information leak. The vulnerability is fixed in 7.0.8.1 and 6.1.7.7.

Record
CVE-2024-26144
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
EUVDEUVD-2024-0573 5.3

Rails is a web-application framework. Starting with version 5.2.0, there is a possible sensitive session information leak in Active Storage. By default, Active Storage sends a Set-Cookie header along with the user's session cookie when serving blobs. It also sets Cache-Control to public. Certain proxies may cache the Set-Cookie, leading to an information leak. The vulnerability is fixed in 7.0.8.1 and 6.1.7.7.

Record
EUVD-2024-0573
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-8h22-8cf7-hq6g 5.3

Rails has possible Sensitive Session Information Leak in Active Storage

Possible Sensitive Session Information Leak in Active Storage

There is a possible sensitive session information leak in Active Storage. By default, Active Storage sends a Set-Cookie header along with the user's session cookie when serving blobs. It also sets Cache-Control to public. Certain proxies may cache the Set-Cookie, leading to an information leak.

This vulnerability has been assigned the CVE identifier CVE-2024-26144.

Versions Affected: >= 5.2.0, < 7.1.0 Not affected: < 5.2.0, > 7.1.0 Fixed Versions: 7.0.8.1, 6.1.7.7

Impact

A proxy which chooses to caches this request can cause users to share sessions. This may include a user receiving an attacker's session or vice versa.

This was patched in 7.1.0 but not previously identified as a security vulnerability.

All users running an affected release should either upgrade or use one of the workarounds immediately.

Releases

The fixed releases are available at the normal locations.

Workarounds

Upgrade to Rails 7.1.X, or configure caching proxies not to cache the Set-Cookie headers.

Credits

Thanks to tyage for reporting this!

Record
GHSA-8h22-8cf7-hq6g
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
NVD 5.3

Rails is a web-application framework. Starting with version 5.2.0, there is a possible sensitive session information leak in Active Storage. By default, Active Storage sends a Set-Cookie header along with the user's session cookie when serving blobs. It also sets Cache-Control to public. Certain proxies may cache the Set-Cookie, leading to an information leak. The vulnerability is fixed in 7.0.8.1 and 6.1.7.7.

Record
CVE-2024-26144
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
OSV 5.3

Possible Sensitive Session Information Leak in Active Storage

Rails is a web-application framework. Starting with version 5.2.0, there is a possible sensitive session information leak in Active Storage. By default, Active Storage sends a Set-Cookie header along with the user's session cookie when serving blobs. It also sets Cache-Control to public. Certain proxies may cache the Set-Cookie, leading to an information leak. The vulnerability is fixed in 7.0.8.1 and 6.1.7.7.

Record
CVE-2024-26144
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
OSVDEBIAN-CVE-2024-26144 5.3

Rails is a web-application framework. Starting with version 5.2.0, there is a possible sensitive session information leak in Active Storage. By default, Active Storage sends a Set-Cookie header along with the user's session cookie when serving blobs. It also sets Cache-Control to public. Certain proxies may cache the Set-Cookie, leading to an information leak. The vulnerability is fixed in 7.0.8.1 and 6.1.7.7.

Record
DEBIAN-CVE-2024-26144
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
Show 8 moreShow less
OSVGHSA-8h22-8cf7-hq6g 5.3

Rails has possible Sensitive Session Information Leak in Active Storage

Possible Sensitive Session Information Leak in Active Storage

There is a possible sensitive session information leak in Active Storage. By default, Active Storage sends a Set-Cookie header along with the user's session cookie when serving blobs. It also sets Cache-Control to public. Certain proxies may cache the Set-Cookie, leading to an information leak.

This vulnerability has been assigned the CVE identifier CVE-2024-26144.

Versions Affected: >= 5.2.0, < 7.1.0 Not affected: < 5.2.0, > 7.1.0 Fixed Versions: 7.0.8.1, 6.1.7.7

Impact

A proxy which chooses to caches this request can cause users to share sessions. This may include a user receiving an attacker's session or vice versa.

This was patched in 7.1.0 but not previously identified as a security vulnerability.

All users running an affected release should either upgrade or use one of the workarounds immediately.

Releases

The fixed releases are available at the normal locations.

Workarounds

Upgrade to Rails 7.1.X, or configure caching proxies not to cache the Set-Cookie headers.

Credits

Thanks to tyage for reporting this!

Record
GHSA-8h22-8cf7-hq6g
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
OSVOESA-2024-1364 5.3

rubygem-activestorage security update

Attach cloud and local files in Rails applications.

Security Fix(es):

Rails is a web-application framework. Starting with version 5.2.0, there is a possible sensitive session information leak in Active Storage. By default, Active Storage sends a Set-Cookie header along with the user's session cookie when serving blobs. It also sets Cache-Control to public. Certain proxies may cache the Set-Cookie, leading to an information leak. The vulnerability is fixed in 7.0.8.1 and 6.1.7.7.(CVE-2024-26144)

Record
OESA-2024-1364
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVOESA-2024-1365 5.3

rubygem-activestorage security update

Attach cloud and local files in Rails applications.

Security Fix(es):

Rails is a web-application framework. Starting with version 5.2.0, there is a possible sensitive session information leak in Active Storage. By default, Active Storage sends a Set-Cookie header along with the user's session cookie when serving blobs. It also sets Cache-Control to public. Certain proxies may cache the Set-Cookie, leading to an information leak. The vulnerability is fixed in 7.0.8.1 and 6.1.7.7.(CVE-2024-26144)

Record
OESA-2024-1365
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVOESA-2024-1366 5.3

rubygem-activestorage security update

Attach cloud and local files in Rails applications.

Security Fix(es):

Rails is a web-application framework. Starting with version 5.2.0, there is a possible sensitive session information leak in Active Storage. By default, Active Storage sends a Set-Cookie header along with the user's session cookie when serving blobs. It also sets Cache-Control to public. Certain proxies may cache the Set-Cookie, leading to an information leak. The vulnerability is fixed in 7.0.8.1 and 6.1.7.7.(CVE-2024-26144)

Record
OESA-2024-1366
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVOESA-2024-1367 5.3

rubygem-activestorage security update

Attach cloud and local files in Rails applications.

Security Fix(es):

Rails is a web-application framework. Starting with version 5.2.0, there is a possible sensitive session information leak in Active Storage. By default, Active Storage sends a Set-Cookie header along with the user's session cookie when serving blobs. It also sets Cache-Control to public. Certain proxies may cache the Set-Cookie, leading to an information leak. The vulnerability is fixed in 7.0.8.1 and 6.1.7.7.(CVE-2024-26144)

Record
OESA-2024-1367
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVRHSA-2024:10806 7.4

Red Hat Security Advisory: Satellite 6.15.5 Async Update

Record
RHSA-2024:10806
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2024-26144 5.3

Rails is a web-application framework. Starting with version 5.2.0, there is a possible sensitive session information leak in Active Storage. By default, Active Storage sends a Set-Cookie header along with the user's session cookie when serving blobs. It also sets Cache-Control to public. Certain proxies may cache the Set-Cookie, leading to an information leak. The vulnerability is fixed in 7.0.8.1 and 6.1.7.7.

Record
UBUNTU-CVE-2024-26144
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVBIT-rails-2024-26144 No score

Possible Sensitive Session Information Leak in Active Storage

Rails is a web-application framework. Starting with version 5.2.0, there is a possible sensitive session information leak in Active Storage. By default, Active Storage sends a Set-Cookie header along with the user's session cookie when serving blobs. It also sets Cache-Control to public. Certain proxies may cache the Set-Cookie, leading to an information leak. The vulnerability is fixed in 7.0.8.1 and 6.1.7.7.

Record
BIT-rails-2024-26144
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
activestorage
RubyGems
 5.2.0 up to 6.1.7.7
6.1.7.7
activestorage
RubyGems
 7.0.0 up to 7.0.8.1
7.0.8.1
rails
Bitnami
 5.2.0 up to 6.1.8, 7.0.0 up to 7.0.9
6.1.87.0.9
rails
Debian:12
 before 2:6.1.7.10+dfsg-1~deb12u1, plus listed versions
2:6.1.7.3+dfsg-12:6.1.7.3+dfsg-102:6.1.7.3+dfsg-112:6.1.7.3+dfsg-122:6.1.7.3+dfsg-13
Show 10 moreShow less
2:6.1.7.3+dfsg-22:6.1.7.3+dfsg-2~deb12u12:6.1.7.3+dfsg-32:6.1.7.3+dfsg-42:6.1.7.3+dfsg-52:6.1.7.3+dfsg-62:6.1.7.3+dfsg-72:6.1.7.3+dfsg-7~exp12:6.1.7.3+dfsg-82:6.1.7.3+dfsg-9
2:6.1.7.10+dfsg-1~deb12u1
rails
Debian:13
 before 2:7.2.2.1+dfsg-1
2:7.2.2.1+dfsg-1
rails
Debian:14
 before 2:7.2.2.1+dfsg-1
2:7.2.2.1+dfsg-1
rails
Debian:12
From an advisory covering 9 CVEs
 before 2:6.1.7.10+dfsg-1~deb12u1, plus listed versions
2:6.1.7.3+dfsg-12:6.1.7.3+dfsg-102:6.1.7.3+dfsg-112:6.1.7.3+dfsg-122:6.1.7.3+dfsg-13
Show 10 moreShow less
2:6.1.7.3+dfsg-22:6.1.7.3+dfsg-2~deb12u12:6.1.7.3+dfsg-32:6.1.7.3+dfsg-42:6.1.7.3+dfsg-52:6.1.7.3+dfsg-62:6.1.7.3+dfsg-72:6.1.7.3+dfsg-7~exp12:6.1.7.3+dfsg-82:6.1.7.3+dfsg-9
2:6.1.7.10+dfsg-1~deb12u1
activestorage
RubyGems
 5.2.0 up to 6.1.7.7, plus listed versions
5.2.15.2.1.15.2.1.rc15.2.25.2.2.1
Show 45 moreShow less
5.2.2.rc15.2.35.2.3.rc15.2.45.2.4.15.2.4.25.2.4.35.2.4.45.2.4.55.2.4.65.2.4.rc15.2.55.2.65.2.6.15.2.6.25.2.6.35.2.75.2.7.15.2.85.2.8.16.0.06.0.0.beta16.0.0.beta26.0.0.beta36.0.0.rc16.0.0.rc26.0.16.0.1.rc16.0.26.0.2.16.0.2.26.0.2.rc16.0.2.rc26.0.36.0.3.16.0.3.26.0.3.36.0.3.46.0.3.56.0.3.66.0.3.76.0.3.rc16.0.46.0.4.16.0.4.2
6.1.7.7
activestorage
RubyGems
 7.0.0 up to 7.0.8.1, plus listed versions
7.0.17.0.27.0.2.17.0.2.27.0.2.3
Show 14 moreShow less
7.0.2.47.0.37.0.3.17.0.47.0.4.17.0.4.27.0.4.37.0.57.0.5.17.0.67.0.77.0.7.17.0.7.27.0.8
7.0.8.1
rubygem-activestorage
openEuler:22.03-LTS
 before 6.1.4.1-2.oe2203
6.1.4.1-2.oe2203
Show 18 moreShow less
Affected packages
PackageAffectedFixed
rubygem-activestorage
openEuler:22.03-LTS-SP1
 before 6.1.4.1-2.oe2203sp1
6.1.4.1-2.oe2203sp1
rubygem-activestorage
openEuler:22.03-LTS-SP2
 before 6.1.4.1-2.oe2203sp2
6.1.4.1-2.oe2203sp2
rubygem-activestorage
openEuler:22.03-LTS-SP3
 before 6.1.4.1-2.oe2203sp3
6.1.4.1-2.oe2203sp3
python-pulp-container
Red Hat:satellite_capsule:6.15::el8
From an advisory covering 5 CVEs
 before 0:2.16.9-2.el8pc
0:2.16.9-2.el8pc
python3.11-pulp-container
Red Hat:satellite_capsule:6.15::el8
From an advisory covering 5 CVEs
 before 0:2.16.9-2.el8pc
0:2.16.9-2.el8pc
python-pulp-container
Red Hat:satellite:6.15::el8
From an advisory covering 5 CVEs
 before 0:2.16.9-2.el8pc
0:2.16.9-2.el8pc
python3.11-pulp-container
Red Hat:satellite:6.15::el8
From an advisory covering 5 CVEs
 before 0:2.16.9-2.el8pc
0:2.16.9-2.el8pc
rubygem-rack
Red Hat:satellite_capsule:6.15::el8
From an advisory covering 5 CVEs
 before 0:2.2.8.1-1.el8sat
0:2.2.8.1-1.el8sat
rubygem-rack
Red Hat:satellite:6.15::el8
From an advisory covering 5 CVEs
 before 0:2.2.8.1-1.el8sat
0:2.2.8.1-1.el8sat
rubygem-activestorage
Red Hat:satellite:6.15::el8
From an advisory covering 5 CVEs
 before 0:6.1.7.7-1.el8sat
0:6.1.7.7-1.el8sat
rails
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
2:4.1.10-12:4.2.5-12:4.2.5.1-12:4.2.5.2-22:4.2.6-12:4.2.6-1ubuntu0.1~esm12:4.2.6-1ubuntu0.1~esm2
 None known
rails
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2:4.2.9-22:4.2.9-42:4.2.10-0ubuntu42:4.2.10-0ubuntu4+esm12:4.2.10-0ubuntu4+esm2
 None known
rails
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
2:5.2.2.1+dfsg-1ubuntu12:5.2.3+dfsg-32:5.2.3+dfsg-3ubuntu0.1~esm1
 None known
rails
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
2:6.0.3.7+dfsg-22:6.1.4.1+dfsg-8ubuntu22:6.1.4.1+dfsg-8ubuntu2+esm1
 None known
rails
Ubuntu:24.04:LTS
 All versions, plus listed versions
2:6.1.7.3+dfsg-2build12:6.1.7.3+dfsg-3
 None known
rails
Ubuntu:25.10
 All versions, plus listed versions
2:6.1.7.3+dfsg-72:7.2.2.1+dfsg-7
 None known
rails
Ubuntu:26.10
 All versions, plus listed versions
2:7.2.3+dfsg-22:7.2.3.2+dfsg-2
 None known
rails
Ubuntu:26.04:LTS
 All versions, plus listed versions
2:7.2.2.1+dfsg-72:7.2.2.2+dfsg-22:7.2.3+dfsg-2
 None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubusutani/study-turbolinks-link2020-04-05
PoC in GitHubgmo-ierae/CVE-2024-26144-test2024-05-24

History

History
RecordedChangedSources
affected, exploits, facts
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-26144 is a medium vulnerability (CVSS 5.3) in Rails, published February 27, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.25%, the 69th percentile. Fixed in activestorage 6.1.7.7.

References

Show 50 moreShow less
This page doesn't list everything

Left out here: 38 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open