- Severity: MEDIUM
- CVE: CVE-2026-126084
- Ecosystems: rubygems, rubygems
- Packages: activestorage, activestorage
### Impact
When a GCS service is configured with the `cache_control` option, `ActiveStorage::Service::GCSService#url_for_direct_upload` signs direct-upload URLs with V4, and the V4 signature covers only the `Cache-Control` and `Host` headers. A direct-upload client can therefore send a `Content-Type` of its choosing, and can omit the declared `Content-MD5`, without invalidating the URL. GCS stores the supplied content type as object metadata, which takes precedence over the `response-content-type` that Active Storage sets on download URLs, so an uploaded object could be served as inline HTML under the application’s bucket path on `storage.googleapis.com`. Script in such an object runs on the storage origin rather than the application’s, but could register a Service Worker scoped to the bucket path and read or replace a victim’s later responses for signed URLs in that bucket.
Applications that use the GCS service with `cache_control` configured and accept direct uploads are affected. GCS services without `cache_control` sign with V2 and are not affected.
### Details
The fixed releases sign every GCS direct-upload URL with V2, which binds an empty `Content-Type` and the declared `Content-MD5`. The configured `Cache-Control` is still returned by `headers_for_direct_upload` and sent by the client, but it is no longer part of the signature, and direct-upload URLs for these services are no longer limited to V4’s seven-day maximum expiry. See the Active Storage CHANGELOG.
### Wor…
Source: GitHub Security Advisories · 2026-11-12