Linux Distros Unpatched Vulnerability : CVE-2026-126084

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(379169);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/11/11");

  script_cve_id("CVE-2026-126084");

  script_name(english:"Linux Distros Unpatched Vulnerability : CVE-2026-126084");

  script_set_attribute(attribute:"synopsis", value:
"The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be
patched.");
  script_set_attribute(attribute:"description", value:
"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied
patch available.

  - Active Storage makes it simple to upload and reference files in cloud services and attach those files to
    Active Record objects. Prior to 8.1.4.1 and 8.0.5.2, when a GCS service is configured with the
    cache_control option, ActiveStorage::Service::GCSService#url_for_direct_upload signs direct-upload URLs
    with V4, and the V4 signature covers only the Cache-Control and Host headers. A direct-upload client can
    therefore send a Content-Type of its choosing, and can omit the declared Content-MD5, without invalidating
    the URL. GCS stores the supplied content type as object metadata, which takes precedence over the
    response-content-type that Active Storage sets on download URLs, so an uploaded object could be served as
    inline HTML under the application's bucket path on storage.googleapis.com. Script in such an object runs
    on the storage origin rather than the application's, but could register a Service Worker scoped to the
    bucket path and read or replace a victim's later responses for signed URLs in that bucket. Applications
    that use the GCS service with cache_control configured and accept direct uploads are affected. GCS
    services without cache_control sign with V2 and are not affected. This issue is fixed in versions 8.1.4.1
    and 8.0.5.2. (CVE-2026-126084)

Note that Nessus relies on the presence of the package as reported by the vendor.");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-126084");
  script_set_attribute(attribute:"solution", value:
"There is no known solution at this time.");
  script_set_attribute(attribute:"agent", value:"unix");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:U/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:U/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-126084");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_set_attribute(attribute:"vendor_unpatched", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/11/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/11/11");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:12.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:13.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:14.0");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:rails");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl", "set_linux_os_id.nasl");
  script_require_keys("Host/cpu", "Host/local_checks_enabled", "global_settings/vendor_unpatched", "Host/OS/identifier");
  script_require_ports("Host/OS/Debian Linux-12", "Host/OS/Debian Linux-13", "Host/OS/Debian Linux-14");

  exit(0);
}

if (!get_kb_item("global_settings/vendor_unpatched")) exit(0, "Unpatched Vulnerabilities Detection not active.");
if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (empty_or_null(get_one_kb_item("Host/Debian/dpkg-l"))) audit(AUDIT_PACKAGE_LIST_MISSING);

include('linux_unpatched.inc');

var distro_constraints_array = {
  "Debian Linux-12": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "12",
        "pkgs": [
          {"reference": "rails"},
          {"reference": "ruby-actioncable"},
          {"reference": "ruby-actionmailbox"},
          {"reference": "ruby-actionmailer"},
          {"reference": "ruby-actionpack"},
          {"reference": "ruby-actiontext"},
          {"reference": "ruby-actionview"},
          {"reference": "ruby-activejob"},
          {"reference": "ruby-activemodel"},
          {"reference": "ruby-activerecord"},
          {"reference": "ruby-activestorage"},
          {"reference": "ruby-activesupport"},
          {"reference": "ruby-rails"},
          {"reference": "ruby-railties"}
        ]
      }
    ]
  },
  "Debian Linux-13": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "13",
        "pkgs": [
          {"reference": "rails"},
          {"reference": "ruby-actioncable"},
          {"reference": "ruby-actionmailbox"},
          {"reference": "ruby-actionmailer"},
          {"reference": "ruby-actionpack"},
          {"reference": "ruby-actiontext"},
          {"reference": "ruby-actionview"},
          {"reference": "ruby-activejob"},
          {"reference": "ruby-activemodel"},
          {"reference": "ruby-activerecord"},
          {"reference": "ruby-activestorage"},
          {"reference": "ruby-activesupport"},
          {"reference": "ruby-rails"},
          {"reference": "ruby-railties"}
        ]
      }
    ]
  },
  "Debian Linux-14": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "14",
        "pkgs": [
          {"reference": "rails"},
          {"reference": "ruby-actioncable"},
          {"reference": "ruby-actionmailbox"},
          {"reference": "ruby-actionmailer"},
          {"reference": "ruby-actionpack"},
          {"reference": "ruby-actiontext"},
          {"reference": "ruby-actionview"},
          {"reference": "ruby-activejob"},
          {"reference": "ruby-activemodel"},
          {"reference": "ruby-activerecord"},
          {"reference": "ruby-activestorage"},
          {"reference": "ruby-activesupport"},
          {"reference": "ruby-rails"},
          {"reference": "ruby-railties"}
        ]
      }
    ]
  }
};

var distro_constraints_values = linux_unpatched::get_distro_constraints(distro_constraints_arr:distro_constraints_array);
if (empty_or_null(distro_constraints_values)) audit(AUDIT_HOST_NOT, 'affected');

var third_party_support = get_kb_item('Host/OS/extended-third-party');
if (!empty_or_null(third_party_support)) {
    var third_party_vendors = distro_constraints_values['third_party'];
    if (!empty_or_null(third_party_vendors)) {
        var vendor;
        foreach vendor (third_party_vendors) {
            if (vendor == third_party_support) exit(0, 'A third party management patch is available for this vulnerability from ' + vendor + '.\n');
        }
    }
}

var report = linux_unpatched::check_unpatched_constraints(distro_constraints_values:distro_constraints_values);

if (!empty_or_null(report))
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : report
  );
  exit(0);
}
else
{
  audit(AUDIT_HOST_NOT, 'affected');
}