Common Weakness Enumeration
CWE-209
AllowedGeneration of Error Message Containing Sensitive Information
Abstraction: Base · Status: Draft
The product generates an error message that includes sensitive information about its environment, users, or associated data.
900 vulnerabilities reference this CWE, most recent first.
CVE-2026-82739 (GCVE-0-2026-82739)
Vulnerability from cvelistv5 – Published: 2026-09-01 03:27 – Updated: 2026-09-01 12:44
VLAI
EPSS
VEX
Title
Ash.Resource.Validation.Confirm leaks a confirmed field's stored value in the atomic mismatch error
Summary
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash discloses the stored value of a confirmed field to an actor who fails its confirmation check.
Ash.Resource.Validation.Confirm's atomic implementation (atomic/2 in lib/ash/resource/validation/confirm.ex) built the mismatch error with its value set to the field being confirmed. When the actor supplies only the confirmation argument and not the field itself, value resolves through atomic_ref/2 to the field's current stored value, so the mismatch error echoes that stored value back to the actor. Against a confirmation guarding a sensitive attribute, an actor can submit a deliberately wrong confirmation and read the real value from the returned error. The fix reports the actor-supplied confirmation in the error instead of the stored field value.
This issue affects ash: from 2.17.20 before 3.32.2.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 12:43 UTC
CWE
- CWE-209 - Generation of Error Message Containing Sensitive Information
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash/security/advis… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82739.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82739 | related |
| https://github.com/ash-project/ash/commit/7dfe5f0… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash |
Affected:
2.17.20 , < 3.32.2
(semver)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
|
| ash-project | ash |
Affected:
fadecf3ee95640bd3bc7298df4799e0375537fd2 , < 7dfe5f0b1ba4267580ded947dc861351d4dc8e2b
(git)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82739",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T12:43:57.417588Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T12:44:21.482Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-66cg-vj5m-8w7v"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Resource.Validation.Confirm\u0027"
],
"packageName": "ash",
"packageURL": "pkg:hex/ash",
"product": "ash",
"programFiles": [
"lib/ash/resource/validation/confirm.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Resource.Validation.Confirm\u0027:atomic/2"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "3.32.2",
"status": "affected",
"version": "2.17.20",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Resource.Validation.Confirm\u0027"
],
"packageName": "ash-project/ash",
"packageURL": "pkg:github/ash-project/ash",
"product": "ash",
"programFiles": [
"lib/ash/resource/validation/confirm.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Resource.Validation.Confirm\u0027:atomic/2"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "7dfe5f0b1ba4267580ded947dc861351d4dc8e2b",
"status": "affected",
"version": "fadecf3ee95640bd3bc7298df4799e0375537fd2",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.32.2",
"versionStartIncluding": "2.17.20",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eGeneration of Error Message Containing Sensitive Information vulnerability in ash-project ash discloses the stored value of a confirmed field to an actor who fails its confirmation check.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eAsh.Resource.Validation.Confirm\u003c/code\u003e\u0027s atomic implementation (\u003ccode\u003eatomic/2\u003c/code\u003e in \u003ccode\u003elib/ash/resource/validation/confirm.ex\u003c/code\u003e) built the mismatch error with its \u003ccode\u003evalue\u003c/code\u003e set to the field being confirmed. When the actor supplies only the confirmation argument and not the field itself, \u003ccode\u003evalue\u003c/code\u003e resolves through \u003ccode\u003eatomic_ref/2\u003c/code\u003e to the field\u0027s current stored value, so the mismatch error echoes that stored value back to the actor. Against a confirmation guarding a sensitive attribute, an actor can submit a deliberately wrong confirmation and read the real value from the returned error. The fix reports the actor-supplied confirmation in the error instead of the stored field value.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash: from 2.17.20 before 3.32.2.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash discloses the stored value of a confirmed field to an actor who fails its confirmation check.\n\n`Ash.Resource.Validation.Confirm`\u0027s atomic implementation (`atomic/2` in `lib/ash/resource/validation/confirm.ex`) built the mismatch error with its `value` set to the field being confirmed. When the actor supplies only the confirmation argument and not the field itself, `value` resolves through `atomic_ref/2` to the field\u0027s current stored value, so the mismatch error echoes that stored value back to the actor. Against a confirmation guarding a sensitive attribute, an actor can submit a deliberately wrong confirmation and read the real value from the returned error. The fix reports the actor-supplied confirmation in the error instead of the stored field value.\n\nThis issue affects ash: from 2.17.20 before 3.32.2."
}
],
"value": "Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash discloses the stored value of a confirmed field to an actor who fails its confirmation check.\n\nAsh.Resource.Validation.Confirm\u0027s atomic implementation (atomic/2 in lib/ash/resource/validation/confirm.ex) built the mismatch error with its value set to the field being confirmed. When the actor supplies only the confirmation argument and not the field itself, value resolves through atomic_ref/2 to the field\u0027s current stored value, so the mismatch error echoes that stored value back to the actor. Against a confirmation guarding a sensitive attribute, an actor can submit a deliberately wrong confirmation and read the real value from the returned error. The fix reports the actor-supplied confirmation in the error instead of the stored field value.\n\nThis issue affects ash: from 2.17.20 before 3.32.2."
}
],
"impacts": [
{
"capecId": "CAPEC-54",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-54 Query System for Information"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 2.1,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-209",
"description": "CWE-209 Generation of Error Message Containing Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T03:27:58.165Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-66cg-vj5m-8w7v"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82739.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82739"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash/commit/7dfe5f0b1ba4267580ded947dc861351d4dc8e2b"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Ash.Resource.Validation.Confirm leaks a confirmed field\u0027s stored value in the atomic mismatch error"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82739",
"datePublished": "2026-09-01T03:27:58.165Z",
"dateReserved": "2026-08-31T00:59:10.002Z",
"dateUpdated": "2026-09-01T12:44:21.482Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82733 (GCVE-0-2026-82733)
Vulnerability from cvelistv5 – Published: 2026-09-01 02:09 – Updated: 2026-09-01 02:09
VLAI
EPSS
VEX
Title
Route handler return value echoed into AshTypescript error response
Summary
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_typescript allows an unauthenticated attacker to read internal application data from an HTTP 500 response body.
When a typed-controller route handler returns anything other than a %Plug.Conn{}, dispatch/3 in lib/ash_typescript/typed_controller/request_handler.ex passes the value to unexpected_return/2, which interpolates inspect(value, limit: 50) directly into the response message. The limit option bounds elements per collection rather than the term as a whole, so a handler falling through with a term such as {:error, %User{}} or a changeset serialises its full field set, including hashed passwords, tokens, and tenant identifiers, into the JSON error returned to the caller.
This contradicts the module's own posture elsewhere: the rescue clause gates Exception.message/1 behind AshTypescript.typed_controller_show_raised_errors?/0 and otherwise returns a generic message, while this path is ungated and always echoes.
This issue affects ash_typescript: from 0.15.0 before 0.18.0.
Severity
CWE
- CWE-209 - Generation of Error Message Containing Sensitive Information
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash_typescript/sec… | relatedvendor-advisory |
| https://cna.erlef.org/cves/CVE-2026-82733.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82733 | related |
| https://github.com/ash-project/ash_typescript/com… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_typescript |
Affected:
0.15.0 , < 0.18.0
(semver)
cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:* |
|
| ash-project | ash_typescript |
Affected:
546a15e1a2d7dbf1df2d5a6ee4404bc3da87852e , < dec80e29543f96e43eeece8501376562f17ac638
(git)
cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshTypescript.TypedController.RequestHandler\u0027"
],
"packageName": "ash_typescript",
"packageURL": "pkg:hex/ash_typescript",
"product": "ash_typescript",
"programFiles": [
"lib/ash_typescript/typed_controller/request_handler.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshTypescript.TypedController.RequestHandler\u0027:unexpected_return/2"
},
{
"name": "\u0027Elixir.AshTypescript.TypedController.RequestHandler\u0027:handle/4"
}
],
"repo": "https://github.com/ash-project/ash_typescript",
"vendor": "ash-project",
"versions": [
{
"lessThan": "0.18.0",
"status": "affected",
"version": "0.15.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshTypescript.TypedController.RequestHandler\u0027"
],
"packageName": "ash-project/ash_typescript",
"packageURL": "pkg:github/ash-project/ash_typescript",
"product": "ash_typescript",
"programFiles": [
"lib/ash_typescript/typed_controller/request_handler.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshTypescript.TypedController.RequestHandler\u0027:unexpected_return/2"
},
{
"name": "\u0027Elixir.AshTypescript.TypedController.RequestHandler\u0027:handle/4"
}
],
"repo": "https://github.com/ash-project/ash_typescript",
"vendor": "ash-project",
"versions": [
{
"lessThan": "dec80e29543f96e43eeece8501376562f17ac638",
"status": "affected",
"version": "546a15e1a2d7dbf1df2d5a6ee4404bc3da87852e",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe application exposes an AshTypescript typed controller over HTTP with a route handler that can return a non-\u003ccode\u003ePlug.Conn\u003c/code\u003e term carrying sensitive data.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "The application exposes an AshTypescript typed controller over HTTP with a route handler that can return a non-`Plug.Conn` term carrying sensitive data."
}
],
"value": "The application exposes an AshTypescript typed controller over HTTP with a route handler that can return a non-Plug.Conn term carrying sensitive data."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.18.0",
"versionStartIncluding": "0.15.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Torkild Gundersen Kjevik / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eGeneration of Error Message Containing Sensitive Information vulnerability in ash-project ash_typescript allows an unauthenticated attacker to read internal application data from an HTTP 500 response body.\u003c/p\u003e\n\u003cp\u003eWhen a typed-controller route handler returns anything other than a \u003ccode\u003e%Plug.Conn{}\u003c/code\u003e, \u003ccode\u003edispatch/3\u003c/code\u003e in \u003ccode\u003elib/ash_typescript/typed_controller/request_handler.ex\u003c/code\u003e passes the value to \u003ccode\u003eunexpected_return/2\u003c/code\u003e, which interpolates \u003ccode\u003einspect(value, limit: 50)\u003c/code\u003e directly into the response message. The \u003ccode\u003elimit\u003c/code\u003e option bounds elements per collection rather than the term as a whole, so a handler falling through with a term such as \u003ccode\u003e{:error, %User{}}\u003c/code\u003e or a changeset serialises its full field set, including hashed passwords, tokens, and tenant identifiers, into the JSON error returned to the caller.\u003c/p\u003e\n\u003cp\u003eThis contradicts the module\u0027s own posture elsewhere: the \u003ccode\u003erescue\u003c/code\u003e clause gates \u003ccode\u003eException.message/1\u003c/code\u003e behind \u003ccode\u003eAshTypescript.typed_controller_show_raised_errors?/0\u003c/code\u003e and otherwise returns a generic message, while this path is ungated and always echoes.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_typescript: from 0.15.0 before 0.18.0.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_typescript allows an unauthenticated attacker to read internal application data from an HTTP 500 response body.\n\nWhen a typed-controller route handler returns anything other than a `%Plug.Conn{}`, `dispatch/3` in `lib/ash_typescript/typed_controller/request_handler.ex` passes the value to `unexpected_return/2`, which interpolates `inspect(value, limit: 50)` directly into the response message. The `limit` option bounds elements per collection rather than the term as a whole, so a handler falling through with a term such as `{:error, %User{}}` or a changeset serialises its full field set, including hashed passwords, tokens, and tenant identifiers, into the JSON error returned to the caller.\n\nThis contradicts the module\u0027s own posture elsewhere: the `rescue` clause gates `Exception.message/1` behind `AshTypescript.typed_controller_show_raised_errors?/0` and otherwise returns a generic message, while this path is ungated and always echoes.\n\nThis issue affects ash_typescript: from 0.15.0 before 0.18.0."
}
],
"value": "Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_typescript allows an unauthenticated attacker to read internal application data from an HTTP 500 response body.\n\nWhen a typed-controller route handler returns anything other than a %Plug.Conn{}, dispatch/3 in lib/ash_typescript/typed_controller/request_handler.ex passes the value to unexpected_return/2, which interpolates inspect(value, limit: 50) directly into the response message. The limit option bounds elements per collection rather than the term as a whole, so a handler falling through with a term such as {:error, %User{}} or a changeset serialises its full field set, including hashed passwords, tokens, and tenant identifiers, into the JSON error returned to the caller.\n\nThis contradicts the module\u0027s own posture elsewhere: the rescue clause gates Exception.message/1 behind AshTypescript.typed_controller_show_raised_errors?/0 and otherwise returns a generic message, while this path is ungated and always echoes.\n\nThis issue affects ash_typescript: from 0.15.0 before 0.18.0."
}
],
"impacts": [
{
"capecId": "CAPEC-54",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-54 Query System for Information"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-209",
"description": "CWE-209 Generation of Error Message Containing Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T02:09:22.784Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"related",
"vendor-advisory"
],
"url": "https://github.com/ash-project/ash_typescript/security/advisories/GHSA-ghhw-qh7p-55xr"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82733.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82733"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_typescript/commit/dec80e29543f96e43eeece8501376562f17ac638"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Route handler return value echoed into AshTypescript error response"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82733",
"datePublished": "2026-09-01T02:09:22.784Z",
"dateReserved": "2026-08-31T00:59:10.001Z",
"dateUpdated": "2026-09-01T02:09:22.784Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82727 (GCVE-0-2026-82727)
Vulnerability from cvelistv5 – Published: 2026-08-31 03:03 – Updated: 2026-08-31 14:49
VLAI
EPSS
VEX
Title
AshPhoenix Form.Auto leaks submitted params in an unknown _union_type error message
Summary
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_phoenix writes the entire raw submitted param map into an exception message, so secrets submitted alongside a union form field leak into logs, crash reports and the dev error page.
When AshPhoenix.Form.Auto builds a union sub-form and the submitted _union_type does not match a configured type, both raise sites built the message with inspect(params, pretty: true), embedding the full untrusted param map, and also inspected the internal union constraints[:types]. Because the message is constructed by the library rather than Phoenix's parameter logger, config :phoenix, :filter_parameters never redacts it. An attacker controls both the trigger and the contents: submitting %{"_union_type" => "nope", "password" => "..."} puts the password verbatim in the raised message. The fix reports only the offending _union_type and the valid type names, dropping the param and constraints dumps.
This issue affects ash_phoenix: from 1.2.17 before 2.3.25.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-31 14:49 UTC
CWE
- CWE-209 - Generation of Error Message Containing Sensitive Information
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash_phoenix/securi… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82727.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82727 | related |
| https://github.com/ash-project/ash_phoenix/commit… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_phoenix |
Affected:
1.2.17 , < 2.3.25
(semver)
cpe:2.3:a:ash-project:ash_phoenix:*:*:*:*:*:*:*:* |
|
| ash-project | ash_phoenix |
Affected:
a3436fcc321e3b34c242cceaf62c3c92bc1a452b , < 0c1775c3cf8988f9abd10a8f92315afc5f06f16d
(git)
cpe:2.3:a:ash-project:ash_phoenix:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82727",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-31T14:49:02.912896Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T14:49:25.154Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ash-project/ash_phoenix/security/advisories/GHSA-5xf4-hgcq-xw7v"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_phoenix:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshPhoenix.Form.Auto\u0027"
],
"packageName": "ash_phoenix",
"packageURL": "pkg:hex/ash_phoenix",
"product": "ash_phoenix",
"programFiles": [
"lib/ash_phoenix/form/auto.ex"
],
"repo": "https://github.com/ash-project/ash_phoenix",
"vendor": "ash-project",
"versions": [
{
"lessThan": "2.3.25",
"status": "affected",
"version": "1.2.17",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_phoenix:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshPhoenix.Form.Auto\u0027"
],
"packageName": "ash-project/ash_phoenix",
"packageURL": "pkg:github/ash-project/ash_phoenix",
"product": "ash_phoenix",
"programFiles": [
"lib/ash_phoenix/form/auto.ex"
],
"repo": "https://github.com/ash-project/ash_phoenix",
"vendor": "ash-project",
"versions": [
{
"lessThan": "0c1775c3cf8988f9abd10a8f92315afc5f06f16d",
"status": "affected",
"version": "a3436fcc321e3b34c242cceaf62c3c92bc1a452b",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe application renders an \u003ccode\u003eAshPhoenix.Form\u003c/code\u003e with a union field, and submitted params (which may carry secrets) reach logs, crash reports or the error page.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "The application renders an `AshPhoenix.Form` with a union field, and submitted params (which may carry secrets) reach logs, crash reports or the error page."
}
],
"value": "The application renders an AshPhoenix.Form with a union field, and submitted params (which may carry secrets) reach logs, crash reports or the error page."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_phoenix:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.3.25",
"versionStartIncluding": "1.2.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eGeneration of Error Message Containing Sensitive Information vulnerability in ash-project ash_phoenix writes the entire raw submitted param map into an exception message, so secrets submitted alongside a union form field leak into logs, crash reports and the dev error page.\u003c/p\u003e\n\u003cp\u003eWhen \u003ccode\u003eAshPhoenix.Form.Auto\u003c/code\u003e builds a union sub-form and the submitted \u003ccode\u003e_union_type\u003c/code\u003e does not match a configured type, both raise sites built the message with \u003ccode\u003einspect(params, pretty: true)\u003c/code\u003e, embedding the full untrusted param map, and also inspected the internal union \u003ccode\u003econstraints[:types]\u003c/code\u003e. Because the message is constructed by the library rather than Phoenix\u0027s parameter logger, \u003ccode\u003econfig :phoenix, :filter_parameters\u003c/code\u003e never redacts it. An attacker controls both the trigger and the contents: submitting \u003ccode\u003e%{\"_union_type\" =\u0026gt; \"nope\", \"password\" =\u0026gt; \"...\"}\u003c/code\u003e puts the password verbatim in the raised message. The fix reports only the offending \u003ccode\u003e_union_type\u003c/code\u003e and the valid type names, dropping the param and constraints dumps.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_phoenix: from 1.2.17 before 2.3.25.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_phoenix writes the entire raw submitted param map into an exception message, so secrets submitted alongside a union form field leak into logs, crash reports and the dev error page.\n\nWhen `AshPhoenix.Form.Auto` builds a union sub-form and the submitted `_union_type` does not match a configured type, both raise sites built the message with `inspect(params, pretty: true)`, embedding the full untrusted param map, and also inspected the internal union `constraints[:types]`. Because the message is constructed by the library rather than Phoenix\u0027s parameter logger, `config :phoenix, :filter_parameters` never redacts it. An attacker controls both the trigger and the contents: submitting `%{\"_union_type\" =\u003e \"nope\", \"password\" =\u003e \"...\"}` puts the password verbatim in the raised message. The fix reports only the offending `_union_type` and the valid type names, dropping the param and constraints dumps.\n\nThis issue affects ash_phoenix: from 1.2.17 before 2.3.25."
}
],
"value": "Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_phoenix writes the entire raw submitted param map into an exception message, so secrets submitted alongside a union form field leak into logs, crash reports and the dev error page.\n\nWhen AshPhoenix.Form.Auto builds a union sub-form and the submitted _union_type does not match a configured type, both raise sites built the message with inspect(params, pretty: true), embedding the full untrusted param map, and also inspected the internal union constraints[:types]. Because the message is constructed by the library rather than Phoenix\u0027s parameter logger, config :phoenix, :filter_parameters never redacts it. An attacker controls both the trigger and the contents: submitting %{\"_union_type\" =\u003e \"nope\", \"password\" =\u003e \"...\"} puts the password verbatim in the raised message. The fix reports only the offending _union_type and the valid type names, dropping the param and constraints dumps.\n\nThis issue affects ash_phoenix: from 1.2.17 before 2.3.25."
}
],
"impacts": [
{
"capecId": "CAPEC-54",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-54 Query System for Information"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-209",
"description": "CWE-209 Generation of Error Message Containing Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T03:03:58.982Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash_phoenix/security/advisories/GHSA-5xf4-hgcq-xw7v"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82727.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82727"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_phoenix/commit/0c1775c3cf8988f9abd10a8f92315afc5f06f16d"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "AshPhoenix Form.Auto leaks submitted params in an unknown _union_type error message"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82727",
"datePublished": "2026-08-31T03:03:58.982Z",
"dateReserved": "2026-08-31T00:59:08.960Z",
"dateUpdated": "2026-08-31T14:49:25.154Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82580 (GCVE-0-2026-82580)
Vulnerability from cvelistv5 – Published: 2026-08-31 01:09 – Updated: 2026-08-31 16:06
VLAI
EPSS
VEX
Title
AshAi echoes raw tool exception messages into the conversation, disclosing internal details
Summary
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_ai discloses internal error text to chat users.
In AshAi.ToolLoop and AshAi.Tools, an exception raised while executing a tool was serialized verbatim with Exception.message/1 into the tool-result content. That content is appended to the conversation, emitted as a {:tool_result, ...} stream event, and sent back to the model, which typically relays it to the user. No filtering happened first, so anything raised inside a tool callback or lifecycle hook (database constraint messages, adapter errors, query fragments, policy or validation internals) was echoed as-is. A chat user who can steer tool arguments into a raising code path receives the raw internal text. The fix routes raised tool errors through the same safe formatter used for other tool errors.
This issue affects ash_ai: from 0.6.0 before 1.0.0.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-31 16:06 UTC
CWE
- CWE-209 - Generation of Error Message Containing Sensitive Information
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash_ai/security/ad… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82580.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82580 | related |
| https://github.com/ash-project/ash_ai/commit/c68d… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_ai |
Affected:
0.6.0 , < 1.0.0
(semver)
cpe:2.3:a:ash-project:ash_ai:*:*:*:*:*:*:*:* |
|
| ash-project | ash_ai |
Affected:
bc2122f78fca6c11d8ec2b9ac53148ec17476460 , < c68dfbdb220426dc015b58379e95bde8e9f0995a
(git)
cpe:2.3:a:ash-project:ash_ai:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82580",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-31T16:06:20.887459Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T16:06:44.151Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ash-project/ash_ai/security/advisories/GHSA-5747-6mpw-6m9c"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_ai:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAi.ToolLoop\u0027",
"\u0027Elixir.AshAi.Tools\u0027"
],
"packageName": "ash_ai",
"packageURL": "pkg:hex/ash_ai",
"product": "ash_ai",
"programFiles": [
"lib/ash_ai/tool_loop.ex",
"lib/ash_ai/tools.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAi.ToolLoop\u0027:run/2"
},
{
"name": "\u0027Elixir.AshAi.Tools\u0027:normalize_extra_tool_error/1"
}
],
"repo": "https://github.com/ash-project/ash_ai",
"vendor": "ash-project",
"versions": [
{
"lessThan": "1.0.0",
"status": "affected",
"version": "0.6.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_ai:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAi.ToolLoop\u0027",
"\u0027Elixir.AshAi.Tools\u0027"
],
"packageName": "ash-project/ash_ai",
"packageURL": "pkg:github/ash-project/ash_ai",
"product": "ash_ai",
"programFiles": [
"lib/ash_ai/tool_loop.ex",
"lib/ash_ai/tools.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAi.ToolLoop\u0027:run/2"
},
{
"name": "\u0027Elixir.AshAi.Tools\u0027:normalize_extra_tool_error/1"
}
],
"repo": "https://github.com/ash-project/ash_ai",
"vendor": "ash-project",
"versions": [
{
"lessThan": "c68dfbdb220426dc015b58379e95bde8e9f0995a",
"status": "affected",
"version": "bc2122f78fca6c11d8ec2b9ac53148ec17476460",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_ai:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.0.0",
"versionStartIncluding": "0.6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eGeneration of Error Message Containing Sensitive Information vulnerability in ash-project ash_ai discloses internal error text to chat users.\u003c/p\u003e\n\u003cp\u003eIn \u003ccode\u003eAshAi.ToolLoop\u003c/code\u003e and \u003ccode\u003eAshAi.Tools\u003c/code\u003e, an exception raised while executing a tool was serialized verbatim with \u003ccode\u003eException.message/1\u003c/code\u003e into the tool-result content. That content is appended to the conversation, emitted as a \u003ccode\u003e{:tool_result, ...}\u003c/code\u003e stream event, and sent back to the model, which typically relays it to the user. No filtering happened first, so anything raised inside a tool callback or lifecycle hook (database constraint messages, adapter errors, query fragments, policy or validation internals) was echoed as-is. A chat user who can steer tool arguments into a raising code path receives the raw internal text. The fix routes raised tool errors through the same safe formatter used for other tool errors.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_ai: from 0.6.0 before 1.0.0.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_ai discloses internal error text to chat users.\n\nIn `AshAi.ToolLoop` and `AshAi.Tools`, an exception raised while executing a tool was serialized verbatim with `Exception.message/1` into the tool-result content. That content is appended to the conversation, emitted as a `{:tool_result, ...}` stream event, and sent back to the model, which typically relays it to the user. No filtering happened first, so anything raised inside a tool callback or lifecycle hook (database constraint messages, adapter errors, query fragments, policy or validation internals) was echoed as-is. A chat user who can steer tool arguments into a raising code path receives the raw internal text. The fix routes raised tool errors through the same safe formatter used for other tool errors.\n\nThis issue affects ash_ai: from 0.6.0 before 1.0.0."
}
],
"value": "Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_ai discloses internal error text to chat users.\n\nIn AshAi.ToolLoop and AshAi.Tools, an exception raised while executing a tool was serialized verbatim with Exception.message/1 into the tool-result content. That content is appended to the conversation, emitted as a {:tool_result, ...} stream event, and sent back to the model, which typically relays it to the user. No filtering happened first, so anything raised inside a tool callback or lifecycle hook (database constraint messages, adapter errors, query fragments, policy or validation internals) was echoed as-is. A chat user who can steer tool arguments into a raising code path receives the raw internal text. The fix routes raised tool errors through the same safe formatter used for other tool errors.\n\nThis issue affects ash_ai: from 0.6.0 before 1.0.0."
}
],
"impacts": [
{
"capecId": "CAPEC-54",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-54 Query System for Information"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-209",
"description": "CWE-209 Generation of Error Message Containing Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T01:09:00.192Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash_ai/security/advisories/GHSA-5747-6mpw-6m9c"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82580.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82580"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_ai/commit/c68dfbdb220426dc015b58379e95bde8e9f0995a"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "AshAi echoes raw tool exception messages into the conversation, disclosing internal details"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82580",
"datePublished": "2026-08-31T01:09:00.192Z",
"dateReserved": "2026-08-30T15:00:01.232Z",
"dateUpdated": "2026-08-31T16:06:44.151Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-79777 (GCVE-0-2026-79777)
Vulnerability from cvelistv5 – Published: 2026-08-25 15:16 – Updated: 2026-08-28 22:25
VLAI
EPSS
VEX
Title
rclone before v1.75.0 Information Disclosure via RC API
Summary
rclone before v1.75.0 includes full Go stack traces in RC API error responses when panics occur. Attackers can trigger panics to leak internal file paths, module versions, goroutine states, and memory addresses.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-28 22:25 UTC
CWE
- CWE-209 - Generation of Error Message Containing Sensitive Information
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/rclone/rclone/security/advisor… | vendor-advisory |
| https://www.vulncheck.com/advisories/rclone-befor… | third-party-advisory |
Impacted products
Date Public
2026-07-31 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-79777",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-28T22:25:13.992087Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T22:25:36.423Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/rclone/rclone/security/advisories/GHSA-gwfq-86j8-7qhv"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/rclone/rclone",
"product": "rclone",
"vendor": "rclone",
"versions": [
{
"lessThan": "1.75.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "1.75.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:rclone:rclone:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.75.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "SnailSploit"
},
{
"lang": "en",
"type": "finder",
"value": "ncw"
}
],
"datePublic": "2026-07-31T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "rclone before v1.75.0 includes full Go stack traces in RC API error responses when panics occur. Attackers can trigger panics to leak internal file paths, module versions, goroutine states, and memory addresses."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 2.7,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-209",
"description": "Generation of Error Message Containing Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T15:16:07.745Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-gwfq-86j8-7qhv)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/rclone/rclone/security/advisories/GHSA-gwfq-86j8-7qhv"
},
{
"name": "VulnCheck Advisory: rclone before v1.75.0 Information Disclosure via RC API",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/rclone-before-information-disclosure-via-rc-api"
}
],
"title": "rclone before v1.75.0 Information Disclosure via RC API",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-79777",
"datePublished": "2026-08-25T15:16:07.745Z",
"dateReserved": "2026-08-25T14:29:43.528Z",
"dateUpdated": "2026-08-28T22:25:36.423Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78693 (GCVE-0-2026-78693)
Vulnerability from cvelistv5 – Published: 2026-08-30 18:28 – Updated: 2026-08-31 15:58
VLAI
EPSS
VEX
Title
Incomplete redaction re-attaches the original error path in AshGraphql, leaking internal field names
Summary
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_graphql allows a remote client to read internal field names that an application configured its error_handler to redact.
In AshGraphql.Errors, each error is passed to the configured error_handler and the returned map is merged with the pre-handler path via Map.put_new(handled, :path, path). Because put_new defers to the handler only when the handler itself set :path, a sanitizing handler that returns a fresh map or deletes :path has that decision reverted. The re-injected path comes from build_error_path/5, which falls back to raw internal Ash attribute and argument names when no field_names mapping is configured. A validation failure on a non-exposed or nested field therefore returns internal names in the GraphQL error path, defeating the application's redaction.
This issue affects ash_graphql: from 1.9.0 before 1.11.0.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-31 15:58 UTC
CWE
- CWE-209 - Generation of Error Message Containing Sensitive Information
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash_graphql/securi… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-78693.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-78693 | related |
| https://github.com/ash-project/ash_graphql/commit… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_graphql |
Affected:
1.9.0 , < 1.11.0
(semver)
cpe:2.3:a:ash-project:ash_graphql:*:*:*:*:*:*:*:* |
|
| ash-project | ash_graphql |
Affected:
6d2d8d995906d68cc245d209a9b3f9853405eb61 , < 78e90d369f09f44c534816de541e60841066a467
(git)
cpe:2.3:a:ash-project:ash_graphql:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-78693",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-31T15:58:21.710895Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T15:58:48.218Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ash-project/ash_graphql/security/advisories/GHSA-ppr2-g9h8-w7qp"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_graphql:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshGraphql.Errors\u0027"
],
"packageName": "ash_graphql",
"packageURL": "pkg:hex/ash_graphql",
"product": "ash_graphql",
"programFiles": [
"lib/graphql/errors.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshGraphql.Errors\u0027:to_errors/6"
}
],
"repo": "https://github.com/ash-project/ash_graphql",
"vendor": "ash-project",
"versions": [
{
"lessThan": "1.11.0",
"status": "affected",
"version": "1.9.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_graphql:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshGraphql.Errors\u0027"
],
"packageName": "ash-project/ash_graphql",
"packageURL": "pkg:github/ash-project/ash_graphql",
"product": "ash_graphql",
"programFiles": [
"lib/graphql/errors.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshGraphql.Errors\u0027:to_errors/6"
}
],
"repo": "https://github.com/ash-project/ash_graphql",
"vendor": "ash-project",
"versions": [
{
"lessThan": "78e90d369f09f44c534816de541e60841066a467",
"status": "affected",
"version": "6d2d8d995906d68cc245d209a9b3f9853405eb61",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_graphql:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.11.0",
"versionStartIncluding": "1.9.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eGeneration of Error Message Containing Sensitive Information vulnerability in ash-project ash_graphql allows a remote client to read internal field names that an application configured its \u003ccode\u003eerror_handler\u003c/code\u003e to redact.\u003c/p\u003e\n\u003cp\u003eIn \u003ccode\u003eAshGraphql.Errors\u003c/code\u003e, each error is passed to the configured \u003ccode\u003eerror_handler\u003c/code\u003e and the returned map is merged with the pre-handler path via \u003ccode\u003eMap.put_new(handled, :path, path)\u003c/code\u003e. Because \u003ccode\u003eput_new\u003c/code\u003e defers to the handler only when the handler itself set \u003ccode\u003e:path\u003c/code\u003e, a sanitizing handler that returns a fresh map or deletes \u003ccode\u003e:path\u003c/code\u003e has that decision reverted. The re-injected path comes from \u003ccode\u003ebuild_error_path/5\u003c/code\u003e, which falls back to raw internal Ash attribute and argument names when no \u003ccode\u003efield_names\u003c/code\u003e mapping is configured. A validation failure on a non-exposed or nested field therefore returns internal names in the GraphQL error \u003ccode\u003epath\u003c/code\u003e, defeating the application\u0027s redaction.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_graphql: from 1.9.0 before 1.11.0.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_graphql allows a remote client to read internal field names that an application configured its `error_handler` to redact.\n\nIn `AshGraphql.Errors`, each error is passed to the configured `error_handler` and the returned map is merged with the pre-handler path via `Map.put_new(handled, :path, path)`. Because `put_new` defers to the handler only when the handler itself set `:path`, a sanitizing handler that returns a fresh map or deletes `:path` has that decision reverted. The re-injected path comes from `build_error_path/5`, which falls back to raw internal Ash attribute and argument names when no `field_names` mapping is configured. A validation failure on a non-exposed or nested field therefore returns internal names in the GraphQL error `path`, defeating the application\u0027s redaction.\n\nThis issue affects ash_graphql: from 1.9.0 before 1.11.0."
}
],
"value": "Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_graphql allows a remote client to read internal field names that an application configured its error_handler to redact.\n\nIn AshGraphql.Errors, each error is passed to the configured error_handler and the returned map is merged with the pre-handler path via Map.put_new(handled, :path, path). Because put_new defers to the handler only when the handler itself set :path, a sanitizing handler that returns a fresh map or deletes :path has that decision reverted. The re-injected path comes from build_error_path/5, which falls back to raw internal Ash attribute and argument names when no field_names mapping is configured. A validation failure on a non-exposed or nested field therefore returns internal names in the GraphQL error path, defeating the application\u0027s redaction.\n\nThis issue affects ash_graphql: from 1.9.0 before 1.11.0."
}
],
"impacts": [
{
"capecId": "CAPEC-54",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-54 Query System for Information"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-209",
"description": "CWE-209 Generation of Error Message Containing Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-30T18:28:35.282Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash_graphql/security/advisories/GHSA-ppr2-g9h8-w7qp"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-78693.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-78693"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_graphql/commit/78e90d369f09f44c534816de541e60841066a467"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Incomplete redaction re-attaches the original error path in AshGraphql, leaking internal field names"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-78693",
"datePublished": "2026-08-30T18:28:35.282Z",
"dateReserved": "2026-08-30T15:30:02.101Z",
"dateUpdated": "2026-08-31T15:58:48.218Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77950 (GCVE-0-2026-77950)
Vulnerability from cvelistv5 – Published: 2026-09-01 02:08 – Updated: 2026-09-01 14:53
VLAI
EPSS
VEX
Title
RPC error handler fails open in AshTypescript, disclosing unredacted errors
Summary
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_typescript allows an unauthenticated attacker to receive unredacted internal error data by provoking an error shape the configured error handler does not match.
apply_error_handler/3 in lib/ash_typescript/rpc/errors.ex is the only hook an application has for redacting or suppressing errors before they reach the client, with a nil return dropping the error entirely. Its rescue clause logs a warning and then returns the original, pre-handler error map. Error handlers are conventionally written as pattern-matching functions over expected error shapes, so an unmatched shape raises FunctionClauseError and the raw transformed error, including any secrets carried in vars, is emitted instead. An intent to suppress an error becomes an intent to publish it. The rescue catches exceptions only, so a handler that throws or exits still propagates.
This issue affects ash_typescript: from 0.8.0 before 0.18.0.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 14:50 UTC
CWE
- CWE-209 - Generation of Error Message Containing Sensitive Information
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash_typescript/sec… | relatedvendor-advisory |
| https://cna.erlef.org/cves/CVE-2026-77950.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-77950 | related |
| https://github.com/ash-project/ash_typescript/com… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_typescript |
Affected:
0.8.0 , < 0.18.0
(semver)
cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:* |
|
| ash-project | ash_typescript |
Affected:
cb01cc8749e5a2a17fb45aedbe75df30a9f1126e , < 59d8e985a98cf2e01794dbe5b919b897a95311f4
(git)
cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77950",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T14:50:21.265873Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T14:53:26.458Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ash-project/ash_typescript/security/advisories/GHSA-mjr7-r3rf-x963"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshTypescript.Rpc.Errors\u0027"
],
"packageName": "ash_typescript",
"packageURL": "pkg:hex/ash_typescript",
"product": "ash_typescript",
"programFiles": [
"lib/ash_typescript/rpc/errors.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshTypescript.Rpc.Errors\u0027:apply_error_handler/3"
},
{
"name": "\u0027Elixir.AshTypescript.Rpc.Errors\u0027:to_errors/5"
}
],
"repo": "https://github.com/ash-project/ash_typescript",
"vendor": "ash-project",
"versions": [
{
"lessThan": "0.18.0",
"status": "affected",
"version": "0.8.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshTypescript.Rpc.Errors\u0027"
],
"packageName": "ash-project/ash_typescript",
"packageURL": "pkg:github/ash-project/ash_typescript",
"product": "ash_typescript",
"programFiles": [
"lib/ash_typescript/rpc/errors.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshTypescript.Rpc.Errors\u0027:apply_error_handler/3"
},
{
"name": "\u0027Elixir.AshTypescript.Rpc.Errors\u0027:to_errors/5"
}
],
"repo": "https://github.com/ash-project/ash_typescript",
"vendor": "ash-project",
"versions": [
{
"lessThan": "59d8e985a98cf2e01794dbe5b919b897a95311f4",
"status": "affected",
"version": "cb01cc8749e5a2a17fb45aedbe75df30a9f1126e",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe application exposes an AshTypescript RPC endpoint over HTTP and configures a custom \u003ccode\u003eerror_handler\u003c/code\u003e in its \u003ccode\u003etypescript_rpc\u003c/code\u003e domain section for redaction or suppression.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "The application exposes an AshTypescript RPC endpoint over HTTP and configures a custom `error_handler` in its `typescript_rpc` domain section for redaction or suppression."
}
],
"value": "The application exposes an AshTypescript RPC endpoint over HTTP and configures a custom error_handler in its typescript_rpc domain section for redaction or suppression."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.18.0",
"versionStartIncluding": "0.8.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Torkild Gundersen Kjevik / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eGeneration of Error Message Containing Sensitive Information vulnerability in ash-project ash_typescript allows an unauthenticated attacker to receive unredacted internal error data by provoking an error shape the configured error handler does not match.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eapply_error_handler/3\u003c/code\u003e in \u003ccode\u003elib/ash_typescript/rpc/errors.ex\u003c/code\u003e is the only hook an application has for redacting or suppressing errors before they reach the client, with a \u003ccode\u003enil\u003c/code\u003e return dropping the error entirely. Its \u003ccode\u003erescue\u003c/code\u003e clause logs a warning and then returns the original, pre-handler error map. Error handlers are conventionally written as pattern-matching functions over expected error shapes, so an unmatched shape raises \u003ccode\u003eFunctionClauseError\u003c/code\u003e and the raw transformed error, including any secrets carried in \u003ccode\u003evars\u003c/code\u003e, is emitted instead. An intent to suppress an error becomes an intent to publish it. The \u003ccode\u003erescue\u003c/code\u003e catches exceptions only, so a handler that throws or exits still propagates.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_typescript: from 0.8.0 before 0.18.0.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_typescript allows an unauthenticated attacker to receive unredacted internal error data by provoking an error shape the configured error handler does not match.\n\n`apply_error_handler/3` in `lib/ash_typescript/rpc/errors.ex` is the only hook an application has for redacting or suppressing errors before they reach the client, with a `nil` return dropping the error entirely. Its `rescue` clause logs a warning and then returns the original, pre-handler error map. Error handlers are conventionally written as pattern-matching functions over expected error shapes, so an unmatched shape raises `FunctionClauseError` and the raw transformed error, including any secrets carried in `vars`, is emitted instead. An intent to suppress an error becomes an intent to publish it. The `rescue` catches exceptions only, so a handler that throws or exits still propagates.\n\nThis issue affects ash_typescript: from 0.8.0 before 0.18.0."
}
],
"value": "Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_typescript allows an unauthenticated attacker to receive unredacted internal error data by provoking an error shape the configured error handler does not match.\n\napply_error_handler/3 in lib/ash_typescript/rpc/errors.ex is the only hook an application has for redacting or suppressing errors before they reach the client, with a nil return dropping the error entirely. Its rescue clause logs a warning and then returns the original, pre-handler error map. Error handlers are conventionally written as pattern-matching functions over expected error shapes, so an unmatched shape raises FunctionClauseError and the raw transformed error, including any secrets carried in vars, is emitted instead. An intent to suppress an error becomes an intent to publish it. The rescue catches exceptions only, so a handler that throws or exits still propagates.\n\nThis issue affects ash_typescript: from 0.8.0 before 0.18.0."
}
],
"impacts": [
{
"capecId": "CAPEC-54",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-54 Query System for Information"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-209",
"description": "CWE-209 Generation of Error Message Containing Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T02:08:54.754Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"related",
"vendor-advisory"
],
"url": "https://github.com/ash-project/ash_typescript/security/advisories/GHSA-mjr7-r3rf-x963"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-77950.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-77950"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_typescript/commit/59d8e985a98cf2e01794dbe5b919b897a95311f4"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "RPC error handler fails open in AshTypescript, disclosing unredacted errors"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-77950",
"datePublished": "2026-09-01T02:08:54.754Z",
"dateReserved": "2026-08-30T17:30:01.402Z",
"dateUpdated": "2026-09-01T14:53:26.458Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77076 (GCVE-0-2026-77076)
Vulnerability from cvelistv5 – Published: 2026-08-20 11:21 – Updated: 2026-08-21 16:43
VLAI
EPSS
VEX
Title
n8n before 1.123.69 Credential Leak via GraphQL Node Error
Summary
n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain an information disclosure vulnerability in the GraphQL node. When a GraphQL request fails at the connection level, the node re-throws the underlying HTTP client error unchanged instead of wrapping it in n8n's standard error type. That error contains the live request's headers, including a decrypted credential secret, which the execution engine persists verbatim. Any authenticated user able to read the resulting execution can retrieve the decrypted credential secret from the stored run data.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-21 16:43 UTC
CWE
- CWE-209 - Generation of Error Message Containing Sensitive Information
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/n8n-io/n8n/security/advisories… | vendor-advisory |
| https://www.vulncheck.com/advisories/n8n-before-c… | third-party-advisory |
Impacted products
Date Public
2026-08-05 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77076",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-21T16:43:00.664837Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T16:43:12.650Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/n8n",
"product": "n8n",
"vendor": "n8n-io",
"versions": [
{
"lessThan": "1.123.69",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "1.123.69",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/n8n",
"product": "n8n",
"vendor": "n8n-io",
"versions": [
{
"lessThan": "2.34.1",
"status": "affected",
"version": "2.34.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.34.1",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/n8n",
"product": "n8n",
"vendor": "n8n-io",
"versions": [
{
"lessThan": "2.33.4",
"status": "affected",
"version": "2.0.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.33.4",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.123.69",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.34.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.33.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Masofgon"
}
],
"datePublic": "2026-08-05T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain an information disclosure vulnerability in the GraphQL node. When a GraphQL request fails at the connection level, the node re-throws the underlying HTTP client error unchanged instead of wrapping it in n8n\u0027s standard error type. That error contains the live request\u0027s headers, including a decrypted credential secret, which the execution engine persists verbatim. Any authenticated user able to read the resulting execution can retrieve the decrypted credential secret from the stored run data."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-209",
"description": "Generation of Error Message Containing Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T11:21:18.839Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-9fqj-7wc5-cwhx)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-9fqj-7wc5-cwhx"
},
{
"name": "VulnCheck Advisory: n8n before 1.123.69 Credential Leak via GraphQL Node Error",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/n8n-before-credential-leak-via-graphql-node-error"
}
],
"title": "n8n before 1.123.69 Credential Leak via GraphQL Node Error",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-77076",
"datePublished": "2026-08-20T11:21:10.251Z",
"dateReserved": "2026-08-20T10:51:39.784Z",
"dateUpdated": "2026-08-21T16:43:12.650Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-75760 (GCVE-0-2026-75760)
Vulnerability from cvelistv5 – Published: 2026-08-31 01:09 – Updated: 2026-08-31 16:07
VLAI
EPSS
VEX
Title
AshAi vectorize change leaks raw embedding-provider errors, including credentials, in a user-facing error
Summary
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_ai discloses provider request state and credentials in a user-facing validation error.
In AshAi.Changes.Vectorize, when the embedding provider call fails the change added a changeset error whose message inspected the raw error term (An error occurred while generating embeddings: #{inspect(error)}). A plain-string add_error produces an Ash.Error.Changes.InvalidChanges in the :invalid class, which AshJsonApi and AshGraphql render back to the caller. The embedding client's error term is not sanitized, so it can carry the request URL, the provider response body, and, for HTTP clients that keep the request in the error struct, the outbound Authorization header with the provider API key. Failures are attacker-reachable via oversized or malformed vectorized content. The fix logs the raw error and returns a generic message.
This issue affects ash_ai: from 0.1.0 before 1.0.0.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-31 16:07 UTC
CWE
- CWE-209 - Generation of Error Message Containing Sensitive Information
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash_ai/security/ad… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-75760.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-75760 | related |
| https://github.com/ash-project/ash_ai/commit/088a… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_ai |
Affected:
0.1.0 , < 1.0.0
(semver)
cpe:2.3:a:ash-project:ash_ai:*:*:*:*:*:*:*:* |
|
| ash-project | ash_ai |
Affected:
5334edc73a007f0629661761d6a75796f2fc0004 , < 088a2562e16d65f36cec178070de683636479f58
(git)
cpe:2.3:a:ash-project:ash_ai:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-75760",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-31T16:07:03.271063Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T16:07:25.476Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ash-project/ash_ai/security/advisories/GHSA-p5cr-mmmf-6w39"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_ai:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAi.Changes.Vectorize\u0027"
],
"packageName": "ash_ai",
"packageURL": "pkg:hex/ash_ai",
"product": "ash_ai",
"programFiles": [
"lib/ash_ai/changes/vectorize.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAi.Changes.Vectorize\u0027:change/3"
}
],
"repo": "https://github.com/ash-project/ash_ai",
"vendor": "ash-project",
"versions": [
{
"lessThan": "1.0.0",
"status": "affected",
"version": "0.1.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_ai:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAi.Changes.Vectorize\u0027"
],
"packageName": "ash-project/ash_ai",
"packageURL": "pkg:github/ash-project/ash_ai",
"product": "ash_ai",
"programFiles": [
"lib/ash_ai/changes/vectorize.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAi.Changes.Vectorize\u0027:change/3"
}
],
"repo": "https://github.com/ash-project/ash_ai",
"vendor": "ash-project",
"versions": [
{
"lessThan": "088a2562e16d65f36cec178070de683636479f58",
"status": "affected",
"version": "5334edc73a007f0629661761d6a75796f2fc0004",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe application exposes a resource with \u003ccode\u003evectorize\u003c/code\u003e configured over an HTTP API (AshJsonApi or AshGraphql) that renders \u003ccode\u003e:invalid\u003c/code\u003e-class changeset errors, and the embedding provider call can be made to fail (for example via oversized content).\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "The application exposes a resource with `vectorize` configured over an HTTP API (AshJsonApi or AshGraphql) that renders `:invalid`-class changeset errors, and the embedding provider call can be made to fail (for example via oversized content)."
}
],
"value": "The application exposes a resource with vectorize configured over an HTTP API (AshJsonApi or AshGraphql) that renders :invalid-class changeset errors, and the embedding provider call can be made to fail (for example via oversized content)."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_ai:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.0.0",
"versionStartIncluding": "0.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eGeneration of Error Message Containing Sensitive Information vulnerability in ash-project ash_ai discloses provider request state and credentials in a user-facing validation error.\u003c/p\u003e\n\u003cp\u003eIn \u003ccode\u003eAshAi.Changes.Vectorize\u003c/code\u003e, when the embedding provider call fails the change added a changeset error whose message inspected the raw error term (\u003ccode\u003eAn error occurred while generating embeddings: #{inspect(error)}\u003c/code\u003e). A plain-string \u003ccode\u003eadd_error\u003c/code\u003e produces an \u003ccode\u003eAsh.Error.Changes.InvalidChanges\u003c/code\u003e in the \u003ccode\u003e:invalid\u003c/code\u003e class, which AshJsonApi and AshGraphql render back to the caller. The embedding client\u0027s error term is not sanitized, so it can carry the request URL, the provider response body, and, for HTTP clients that keep the request in the error struct, the outbound \u003ccode\u003eAuthorization\u003c/code\u003e header with the provider API key. Failures are attacker-reachable via oversized or malformed vectorized content. The fix logs the raw error and returns a generic message.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_ai: from 0.1.0 before 1.0.0.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_ai discloses provider request state and credentials in a user-facing validation error.\n\nIn `AshAi.Changes.Vectorize`, when the embedding provider call fails the change added a changeset error whose message inspected the raw error term (`An error occurred while generating embeddings: #{inspect(error)}`). A plain-string `add_error` produces an `Ash.Error.Changes.InvalidChanges` in the `:invalid` class, which AshJsonApi and AshGraphql render back to the caller. The embedding client\u0027s error term is not sanitized, so it can carry the request URL, the provider response body, and, for HTTP clients that keep the request in the error struct, the outbound `Authorization` header with the provider API key. Failures are attacker-reachable via oversized or malformed vectorized content. The fix logs the raw error and returns a generic message.\n\nThis issue affects ash_ai: from 0.1.0 before 1.0.0."
}
],
"value": "Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_ai discloses provider request state and credentials in a user-facing validation error.\n\nIn AshAi.Changes.Vectorize, when the embedding provider call fails the change added a changeset error whose message inspected the raw error term (An error occurred while generating embeddings: #{inspect(error)}). A plain-string add_error produces an Ash.Error.Changes.InvalidChanges in the :invalid class, which AshJsonApi and AshGraphql render back to the caller. The embedding client\u0027s error term is not sanitized, so it can carry the request URL, the provider response body, and, for HTTP clients that keep the request in the error struct, the outbound Authorization header with the provider API key. Failures are attacker-reachable via oversized or malformed vectorized content. The fix logs the raw error and returns a generic message.\n\nThis issue affects ash_ai: from 0.1.0 before 1.0.0."
}
],
"impacts": [
{
"capecId": "CAPEC-54",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-54 Query System for Information"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-209",
"description": "CWE-209 Generation of Error Message Containing Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T01:09:59.413Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash_ai/security/advisories/GHSA-p5cr-mmmf-6w39"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-75760.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-75760"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_ai/commit/088a2562e16d65f36cec178070de683636479f58"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "AshAi vectorize change leaks raw embedding-provider errors, including credentials, in a user-facing error"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-75760",
"datePublished": "2026-08-31T01:09:59.413Z",
"dateReserved": "2026-08-30T23:15:02.367Z",
"dateUpdated": "2026-08-31T16:07:25.476Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74879 (GCVE-0-2026-74879)
Vulnerability from cvelistv5 – Published: 2026-08-17 11:04 – Updated: 2026-08-17 16:03
VLAI
EPSS
VEX
Title
openssl_encrypt before 1.4.0 Information Disclosure via /ready endpoint
Summary
openssl_encrypt versions before 1.4.0 contain an information disclosure vulnerability in the /ready endpoint that returns full database exception strings to unauthenticated callers. Attackers can trigger database errors to extract sensitive information including hostnames, IP addresses, connection parameters, and potentially credentials from exception messages.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-17 15:44 UTC
CWE
- CWE-209 - Generation of Error Message Containing Sensitive Information
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/jahlives/openssl_encrypt/secur… | vendor-advisory |
| https://www.vulncheck.com/advisories/openssl-encr… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| jahlives | openssl_encrypt |
Affected:
0 , < 1.4.0
(semver)
Unaffected: 1.4.0 (semver) |
Date Public
2026-02-10 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74879",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-17T15:44:41.768802Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T16:03:59.327Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/openssl_encrypt",
"product": "openssl_encrypt",
"vendor": "jahlives",
"versions": [
{
"lessThan": "1.4.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "1.4.0",
"versionType": "semver"
}
]
}
],
"datePublic": "2026-02-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "openssl_encrypt versions before 1.4.0 contain an information disclosure vulnerability in the /ready endpoint that returns full database exception strings to unauthenticated callers. Attackers can trigger database errors to extract sensitive information including hostnames, IP addresses, connection parameters, and potentially credentials from exception messages."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-209",
"description": "Generation of Error Message Containing Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T11:04:46.428Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-2vhw-q7vh-7xv2)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-2vhw-q7vh-7xv2"
},
{
"name": "VulnCheck Advisory: openssl_encrypt before 1.4.0 Information Disclosure via /ready endpoint",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/openssl-encrypt-before-information-disclosure-via-ready-endpoint"
}
],
"title": "openssl_encrypt before 1.4.0 Information Disclosure via /ready endpoint",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-74879",
"datePublished": "2026-08-17T11:04:46.428Z",
"dateReserved": "2026-08-17T10:36:18.505Z",
"dateUpdated": "2026-08-17T16:03:59.327Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation MIT-39
Implementation
- Ensure that error messages only contain minimal details that are useful to the intended audience and no one else. The messages need to strike the balance between being too cryptic (which can confuse users) or being too detailed (which may reveal more than intended). The messages should not reveal the methods that were used to determine the error. Attackers can use detailed information to refine or optimize their original attack, thereby increasing their chances of success.
- If errors must be captured in some detail, record them in log messages, but consider what could occur if the log messages can be viewed by attackers. Highly sensitive information such as passwords should never be saved to log files.
- Avoid inconsistent messaging that might accidentally tip off an attacker about internal state, such as whether a user account exists or not.
Mitigation
Implementation
Handle exceptions internally and do not display errors containing potentially sensitive information to a user.
Mitigation MIT-33
Implementation
Strategy: Attack Surface Reduction
Use naming conventions and strong types to make it easier to spot when sensitive data is being used. When creating structures, objects, or other complex entities, separate the sensitive and non-sensitive data as much as possible.
Mitigation MIT-40
Implementation
Build and Compilation
Strategy: Compilation or Build Hardening
Debugging information should not make its way into a production release.
Mitigation MIT-40
Implementation
Build and Compilation
Strategy: Environment Hardening
Debugging information should not make its way into a production release.
Mitigation
System Configuration
Where available, configure the environment to use less verbose error messages. For example, in PHP, disable the display_errors setting during configuration, or at runtime using the error_reporting() function.
Mitigation
System Configuration
Create default error pages or messages that do not leak any information.
CAPEC-215: Fuzzing for application mapping
An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes the application's log or error messages returned. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's desired behavior. In this attack, the purpose of the fuzzing is to observe the application's log and error messages, although fuzzing a target can also sometimes cause the target to enter an unstable state, causing a crash.
CAPEC-463: Padding Oracle Crypto Attack
An adversary is able to efficiently decrypt data without knowing the decryption key if a target system leaks data on whether or not a padding error happened while decrypting the ciphertext. A target system that leaks this type of information becomes the padding oracle and an adversary is able to make use of that oracle to efficiently decrypt data without knowing the decryption key by issuing on average 128*b calls to the padding oracle (where b is the number of bytes in the ciphertext block). In addition to performing decryption, an adversary is also able to produce valid ciphertexts (i.e., perform encryption) by using the padding oracle, all without knowing the encryption key.
CAPEC-54: Query System for Information
An adversary, aware of an application's location (and possibly authorized to use the application), probes an application's structure and evaluates its robustness by submitting requests and examining responses. Often, this is accomplished by sending variants of expected queries in the hope that these modified queries might return information beyond what the expected set of queries would provide.
CAPEC-7: Blind SQL Injection
Blind SQL Injection results from an insufficient mitigation for SQL Injection. Although suppressing database error messages are considered best practice, the suppression alone is not sufficient to prevent SQL Injection. Blind SQL Injection is a form of SQL Injection that overcomes the lack of error messages. Without the error messages that facilitate SQL Injection, the adversary constructs input strings that probe the target through simple Boolean SQL expressions. The adversary can determine if the syntax and structure of the injection was successful based on whether the query was executed or not. Applied iteratively, the adversary determines how and where the target is vulnerable to SQL Injection.