CVE-2026-34830
Rack ≤ 2.2.23
Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NSummary
CVE-2026-34830 is a medium-severity Permissive Regular Expression (CWE-625) vulnerability in Rack Rack. Its CVSS base score is 5.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 11th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-34830 is a vulnerability in Rack, a modular Ruby web server interface, affecting versions prior to 2.2.23, 3.1.21, and 3.2.6. The issue resides in the Rack::Sendfile#map_accel_path method, which directly interpolates the value of the X-Accel-Mapping request header into a regular expression during file path rewriting for X-Accel-Redirect responses. Due to the lack of escaping, this enables regex metacharacter injection, allowing manipulation of the generated X-Accel-Redirect header.
An attacker who can supply the X-Accel-Mapping header to the backend application—typically remotely over the network without privileges—can exploit this with high attack complexity to inject regex metacharacters and control the X-Accel-Redirect response. In deployments configured with Rack::Sendfile and x-accel-redirect alongside nginx, this results in nginx serving unintended files from internal locations, leading to unauthorized data disclosure. The vulnerability has a CVSS v3.1 base score of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) and is classified under CWE-625 (Permissible Value).
The vulnerability has been addressed in Rack versions 2.2.23, 3.1.21, and 3.2.6. Additional details on the patch and remediation are available in the GitHub security advisory at https://github.com/rack/rack/security/advisories/GHSA-qv7j-4883-hwh7.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-18390
Vulnerability Data
Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Sendfile#map_accel_path interpolates the value of the X-Accel-Mapping request header directly into a regular expression when rewriting file paths for X-Accel-Redirect. Because the header value is…
more
not escaped, an attacker who can supply X-Accel-Mapping to the backend can inject regex metacharacters and control the generated X-Accel-Redirect response header. In deployments using Rack::Sendfile with x-accel-redirect, this can allow an attacker to cause nginx to serve unintended files from configured internal locations. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 requires validity checks on inputs, directly stopping permissive regex patterns from being used for validation.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require robust input-validation regex and testing that would prevent permissive patterns.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect permissive regex through fuzzing or negative test cases.
Secure development lifecycle requires validation of input mechanisms, including regex, reducing permissive patterns.
Application security requirements mandate strict input validation rules that would catch overly permissive regex.
Secure coding standards directly prohibit permissive regex and enforce strict pattern validation.