Rack::Session is a session management implementation for Rack. From 2.0.0 to before 2.1.2, Rack::Session::Cookie incorrectly handles decryption failures when configured with secrets:. If cookie decryption fails, the implementation falls back to a default decoder instead of rejecting the cookie. This allows an unauthenticated attacker to supply a crafted session cookie that is accepted as valid session data without knowledge of any configured secret. Because this mechanism is used to load session state, an attacker can manipulate session contents and potentially gain unauthorized access. This vulnerability is fixed in 2.1.2.

The remote Ubuntu 25.10 host has a package installed that is affected by a vulnerability as referenced in the USN-8190-1 advisory.

    SeungMyung Lee discovered that Rack::Session did not properly reject cookies upon decryption failure. A     remote attacker could use this issue to manipulate session contents and possibly gain unauthorized access.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Rack::Session is a session management implementation for Rack. From 2.0.0 to before 2.1.2,
    Rack::Session::Cookie incorrectly handles decryption failures when configured with secrets:. If cookie
    decryption fails, the implementation falls back to a default decoder instead of rejecting the cookie. This
    allows an unauthenticated attacker to supply a crafted session cookie that is accepted as valid session
    data without knowledge of any configured secret. Because this mechanism is used to load session state, an
    attacker can manipulate session contents and potentially gain unauthorized access. This vulnerability is
    fixed in 2.1.2. (CVE-2026-39324)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Rack::Session is a session management implementation for Rack. From 2.0.0 to before 2.1.2,     Rack::Session::Cookie incorrectly handles decryption failures when configured with secrets:. If cookie     decryption fails, the implementation falls back to a default decoder instead of rejecting the cookie. This     allows an unauthenticated attacker to supply a crafted session cookie that is accepted as valid session     data without knowledge of any configured secret. Because this mechanism is used to load session state, an     attacker can manipulate session contents and potentially gain unauthorized access. This vulnerability is     fixed in 2.1.2. (CVE-2026-39324)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
307893	Ubuntu 25.10 : Rack::Session vulnerability (USN-8190-1)	Nessus	Ubuntu Local Security Checks	Local	critical
440003	SCA: security update for rack-session (GHSA-33qg-7wpp-89cq)	Tenable Cloud Security	SCA Checks	Local	critical
440003	SCA: security update for rack-session (GHSA-33qg-7wpp-89cq)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical
305252	Linux Distros Unpatched Vulnerability : CVE-2026-39324	Nessus	Misc.	Local	critical

Detections

Analytics

CVE-2026-39324

critical

Tenable Plugins

critical

critical

critical

critical