DANGER: Unauthenticated Action Cable Exploit Enables Server Crashes
A high-severity denial-of-service vulnerability in Ruby on Rails Active Support allows unauthenticated attackers to crash application servers by exploiting a flaw in the `safe_constantize` method. The vulnerability, tracked as CVE-2026-126080 with a CVSS score of 7.5, affects Rails applications that mount Action Cable endpoints.
Vulnerability Details
When constant lookup raises a `LoadError`, the `ActiveSupport::Inflector#safe_constantize` method (and `String#safe_constantize`) builds a regular expression from the requested constant name without properly escaping it. This allows attackers who control the input to craft patterns that trigger defects in Ruby’s regular expression compiler, potentially causing server process crashes.
Action Cable passes the `channel` value of each `subscribe` command to `safe_constantize` before any channel lookup. In the default configuration, an unauthenticated client of the Action Cable endpoint can reach this vulnerable code path. New Rails applications mount Action Cable by default at `/cable` via `config.action_cable.mount_path`.
Affected Applications
Applications are vulnerable if they meet all of these conditions:
- Mount Action Cable (default at `/cable`) or otherwise pass untrusted input to `safe_constantize`
- Accept Action Cable connections from untrusted clients
- Do not authenticate connections in `ApplicationCable::Connection#connect` (the default behavior unless explicitly added)
Repeated malicious requests could keep affected applications unavailable through sustained denial of service.
Affected Versions
- activesupport >= 8.1.0.beta1, < 8.1.4.1
- activesupport < 8.0.5.2
Patches and Mitigation
Patched versions are available:
- activesupport 8.1.4.1
- activesupport 8.0.5.2
The fix changes the constant name validation to match the first segment against the error message as a literal string rather than compiling a regular expression. This returns the same result as before for constant names containing no regex syntax.
For applications unable to upgrade immediately:
- Applications not using Action Cable can set `config.action_cable.mount_path = nil` to remove the endpoint
- Applications using Action Cable can call `reject_unauthorized_connection` in `ApplicationCable::Connection#connect` for unauthenticated clients, though this only limits exposure to authenticated users and does not fully remove the vulnerability
Patch files are available for manual application:
- Rails 8.1: https://github.com/rails/rails/commit/95aa9e416016524956d4904fed96eaed079580bb.patch
- Rails 8.0: https://github.com/rails/rails/commit/210ac22d446c8e2625b091e79256806b836eee20.patch
Discovery and Attribution
The vulnerability was responsibly reported by Felix Tscheulin (flixt) through HackerOne researcher scheja, and independently discovered by Bucky Wolfe (Igneous), who provided a proof-of-concept demonstrating server crashes. The Anthropic OSS Scanner also independently identified the issue (ANT-2026-ZUN5KU3Q).
