Linux Distros Unpatched Vulnerability : CVE-2026-126068

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(379182);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/11/13");

  script_cve_id("CVE-2026-126068");

  script_name(english:"Linux Distros Unpatched Vulnerability : CVE-2026-126068");

  script_set_attribute(attribute:"synopsis", value:
"The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be
patched.");
  script_set_attribute(attribute:"description", value:
"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied
patch available.

  - Action Mailbox routes incoming emails to controller-like mailboxes for processing in Rails. Prior to
    8.1.4.1 and 8.0.5.2, the Action Mailbox Mailgun ingress authenticates a request with an HMAC of the
    timestamp and token parameters concatenated without a separator, and
    ActionMailbox::Ingresses::Mailgun::InboundEmailsController::Authenticator#recent? rejects only timestamps
    more than 2 minutes in the past. Because the signature does not fix the boundary between the two values, a
    captured signed request can be presented with a timestamp far in the future, which the ingress then
    accepts indefinitely. An attacker who obtains one signed Mailgun webhook request, but not the signing key,
    could submit arbitrary inbound email that Action Mailbox processes as genuine, possibly leading to forged
    messages attributed to the sender of the attacker's choosing. Applications that receive inbound email
    through the Action Mailbox Mailgun ingress are affected. This issue is fixed in versions 8.1.4.1 and
    8.0.5.2. (CVE-2026-126068)

Note that Nessus relies on the presence of the package as reported by the vendor.");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-126068");
  script_set_attribute(attribute:"solution", value:
"There is no known solution at this time.");
  script_set_attribute(attribute:"agent", value:"unix");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:N/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:U/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:U/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-126068");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_set_attribute(attribute:"vendor_unpatched", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/11/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/11/11");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:12.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:13.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:14.0");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:rails");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl", "set_linux_os_id.nasl");
  script_require_keys("Host/cpu", "Host/local_checks_enabled", "global_settings/vendor_unpatched", "Host/OS/identifier");
  script_require_ports("Host/OS/Debian Linux-12", "Host/OS/Debian Linux-13", "Host/OS/Debian Linux-14");

  exit(0);
}

if (!get_kb_item("global_settings/vendor_unpatched")) exit(0, "Unpatched Vulnerabilities Detection not active.");
if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (empty_or_null(get_one_kb_item("Host/Debian/dpkg-l"))) audit(AUDIT_PACKAGE_LIST_MISSING);

include('linux_unpatched.inc');

var distro_constraints_array = {
  "Debian Linux-12": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "12",
        "pkgs": [
          {"reference": "rails"},
          {"reference": "ruby-actioncable"},
          {"reference": "ruby-actionmailbox"},
          {"reference": "ruby-actionmailer"},
          {"reference": "ruby-actionpack"},
          {"reference": "ruby-actiontext"},
          {"reference": "ruby-actionview"},
          {"reference": "ruby-activejob"},
          {"reference": "ruby-activemodel"},
          {"reference": "ruby-activerecord"},
          {"reference": "ruby-activestorage"},
          {"reference": "ruby-activesupport"},
          {"reference": "ruby-rails"},
          {"reference": "ruby-railties"}
        ]
      }
    ]
  },
  "Debian Linux-13": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "13",
        "pkgs": [
          {"reference": "rails"},
          {"reference": "ruby-actioncable"},
          {"reference": "ruby-actionmailbox"},
          {"reference": "ruby-actionmailer"},
          {"reference": "ruby-actionpack"},
          {"reference": "ruby-actiontext"},
          {"reference": "ruby-actionview"},
          {"reference": "ruby-activejob"},
          {"reference": "ruby-activemodel"},
          {"reference": "ruby-activerecord"},
          {"reference": "ruby-activestorage"},
          {"reference": "ruby-activesupport"},
          {"reference": "ruby-rails"},
          {"reference": "ruby-railties"}
        ]
      }
    ]
  },
  "Debian Linux-14": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "14",
        "pkgs": [
          {"reference": "rails"},
          {"reference": "ruby-actioncable"},
          {"reference": "ruby-actionmailbox"},
          {"reference": "ruby-actionmailer"},
          {"reference": "ruby-actionpack"},
          {"reference": "ruby-actiontext"},
          {"reference": "ruby-actionview"},
          {"reference": "ruby-activejob"},
          {"reference": "ruby-activemodel"},
          {"reference": "ruby-activerecord"},
          {"reference": "ruby-activestorage"},
          {"reference": "ruby-activesupport"},
          {"reference": "ruby-rails"},
          {"reference": "ruby-railties"}
        ]
      }
    ]
  }
};

var distro_constraints_values = linux_unpatched::get_distro_constraints(distro_constraints_arr:distro_constraints_array);
if (empty_or_null(distro_constraints_values)) audit(AUDIT_HOST_NOT, 'affected');

var third_party_support = get_kb_item('Host/OS/extended-third-party');
if (!empty_or_null(third_party_support)) {
    var third_party_vendors = distro_constraints_values['third_party'];
    if (!empty_or_null(third_party_vendors)) {
        var vendor;
        foreach vendor (third_party_vendors) {
            if (vendor == third_party_support) exit(0, 'A third party management patch is available for this vulnerability from ' + vendor + '.\n');
        }
    }
}

var report = linux_unpatched::check_unpatched_constraints(distro_constraints_values:distro_constraints_values);

if (!empty_or_null(report))
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_NOTE,
      extra      : report
  );
  exit(0);
}
else
{
  audit(AUDIT_HOST_NOT, 'affected');
}