Rack CVE-2026-34786

Despite the 5.3 CVSS score (moderate), the real-world risk depends heavily on deployment context. The attack vector is network-accessible and requires no authentication or user interaction (AV:N, AC:L, PR:N, UI:N), and the integrity impact (I:L) reflects the ability to bypass intended security headers rather than direct file manipulation. EPSS data is not provided, but the attack requires: (1) knowledge that Rack::Static with header_rules exists in the target application, (2) understanding of which headers are security-critical, and (3) confirmation that URL encoding bypasses rule matching. The absence of confirmed KEV status or public exploit code suggests this is a real but not actively weaponized vulnerability. However, for applications using Rack::Static as a Content-Security-Policy enforcement layer, this could be critical; for others, it is a defense-in-depth issue. Organizations should prioritize patching if they explicitly configure header_rules in Rack::Static.

An attacker targeting a Rails application protected by a Content-Security-Policy header applied via Rack::Static header_rules discovers that requesting /assets/app.js applies the CSP header, preventing inline script injection. The attacker then requests /assets%2Fapp.js (percent-encoded path separator) and receives the same JavaScript file but without the CSP header, enabling them to inject or inject a malicious script that would normally be blocked. If the application relies solely on Rack::Static for CSP enforcement, this bypass allows script injection attacks against users loading the application.