CVE-2020-8165: Ruby on Rails cache store deserialization leads to RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, no authentication, and RCE impact, plus high EPSS and public exploit references, make this an urgent fix.

What it is

Ruby on Rails before 5.2.4.3 and before 6.0.3.1 deserializes untrusted data in MemCacheStore and RedisCacheStore, allowing attacker-supplied objects to be unmarshalled. Because the flaw is reachable without authentication and can end in remote code execution, it is a serious risk for any application using these cache stores.

Impact

An attacker can execute arbitrary code in the context of the Rails application, leading to full server compromise and access to application data and secrets.

Attack surface

The vulnerability is network-reachable (AV:N) with no privileges or user interaction required (PR:N, UI:N), meaning any request path that causes the cache store to deserialize attacker-controlled data can trigger it.

Exploitation

Not listed in CISA KEV, but EPSS is 0.45732 (98.7th percentile) and references include an Exploit-tagged HackerOne report, indicating public exploit material exists.

What to do

• Upgrade Rails to 5.2.4.3, 6.0.3.1 or later, or apply the vendor patch referenced in the Rails security announcement.
• Update distribution packages (Debian DSA-4766, openSUSE advisories) to the fixed versions.
• Avoid deserializing untrusted data through MemCacheStore or RedisCacheStore; validate or restrict what enters the cache.
• If immediate patching is not possible, isolate affected Rails services and restrict network access to their cache backends.

Detection

• Monitor Rails application logs for deserialization errors or unexpected object unmarshalling in cache operations.
• Inspect network traffic to Memcached and Redis for serialized payloads containing suspicious Ruby object markers.
• Watch for anomalous child processes or outbound connections spawned by the Rails application process.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.