Search
Find a vulnerability
Search criteria
186 vulnerabilities by ash-project
CVE-2026-119613 (GCVE-0-2026-119613)
Vulnerability from nvd – Published: 2026-11-09 13:03 – Updated: 2026-11-12 16:11
VLAI
EPSS
VEX
Title
AshAi sends unrecognized tool errors verbatim to MCP clients and the model, disclosing internal details
Summary
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_ai allows a caller of an AshAi tool to read internal error details, including module names and data values, by making a tool call fail.
AshAi.ToToolError gained an implementation for Ash.Error.Unknown.UnknownError that returns the error's error field as is, and AshAi.Tool.Errors.format/1 sends that text to MCP clients (tool calls and resource reads in AshAi.Mcp.Server) and to the model in AshAi.ToolLoop. Ash stores the full Exception.format/2 output of a raised exception, or inspect/1 of a bare {:error, term} return, in that field. A tool result that cannot be JSON-encoded raises a Protocol.UndefinedError whose text includes the inspected value, which can be a whole record with fields the tool never returns. None of these errors were logged. The fix logs them under an error id and returns only that id to the caller.
This issue affects ash_ai: from 1.5.0 before 1.5.1.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-12 16:10 UTC
CWE
- CWE-209 - Generation of Error Message Containing Sensitive Information
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash_ai/security/ad… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-119613.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-119613 | related |
| https://github.com/ash-project/ash_ai/commit/fbad… | related |
| https://github.com/ash-project/ash_ai/commit/af79… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_ai |
Affected:
1.5.0 , < 1.5.1
(semver)
cpe:2.3:a:ash-project:ash_ai:*:*:*:*:*:*:*:* |
|
| ash-project | ash_ai |
Affected:
fbad04e9620ef70603f4e67e03f15092f58578f6 , < af7987769d78ed070c8a9f6e6ee542d91744eae6
(git)
cpe:2.3:a:ash-project:ash_ai:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119613",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-12T16:10:54.442769Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T16:11:19.623Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ash-project/ash_ai/security/advisories/GHSA-vhmw-fwrr-r6c6"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_ai:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAi.ToToolError.Ash.Error.Unknown.UnknownError\u0027",
"\u0027Elixir.AshAi.Tool.Errors\u0027",
"\u0027Elixir.AshAi.Mcp.Router\u0027",
"\u0027Elixir.AshAi.ToolLoop\u0027"
],
"packageName": "ash_ai",
"packageURL": "pkg:hex/ash_ai",
"product": "ash_ai",
"programFiles": [
"lib/ash_ai/to_tool_error.ex",
"lib/ash_ai/tool/errors.ex",
"lib/ash_ai/mcp/router.ex",
"lib/ash_ai/tool_loop.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAi.ToToolError.Ash.Error.Unknown.UnknownError\u0027:to_tool_error/1"
},
{
"name": "\u0027Elixir.AshAi.Tool.Errors\u0027:format/1"
},
{
"name": "\u0027Elixir.AshAi.Mcp.Router\u0027:call/2"
},
{
"name": "\u0027Elixir.AshAi.ToolLoop\u0027:run/2"
}
],
"repo": "https://github.com/ash-project/ash_ai",
"vendor": "ash-project",
"versions": [
{
"lessThan": "1.5.1",
"status": "affected",
"version": "1.5.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_ai:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAi.ToToolError.Ash.Error.Unknown.UnknownError\u0027",
"\u0027Elixir.AshAi.Tool.Errors\u0027",
"\u0027Elixir.AshAi.Mcp.Router\u0027",
"\u0027Elixir.AshAi.ToolLoop\u0027"
],
"packageName": "ash-project/ash_ai",
"packageURL": "pkg:github/ash-project/ash_ai",
"product": "ash_ai",
"programFiles": [
"lib/ash_ai/to_tool_error.ex",
"lib/ash_ai/tool/errors.ex",
"lib/ash_ai/mcp/router.ex",
"lib/ash_ai/tool_loop.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAi.ToToolError.Ash.Error.Unknown.UnknownError\u0027:to_tool_error/1"
},
{
"name": "\u0027Elixir.AshAi.Tool.Errors\u0027:format/1"
},
{
"name": "\u0027Elixir.AshAi.Mcp.Router\u0027:call/2"
},
{
"name": "\u0027Elixir.AshAi.ToolLoop\u0027:run/2"
}
],
"repo": "https://github.com/ash-project/ash_ai",
"vendor": "ash-project",
"versions": [
{
"lessThan": "af7987769d78ed070c8a9f6e6ee542d91744eae6",
"status": "affected",
"version": "fbad04e9620ef70603f4e67e03f15092f58578f6",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_ai:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.5.1",
"versionStartIncluding": "1.5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Sebastian Seilund"
},
{
"lang": "en",
"type": "reporter",
"value": "Sebastian Seilund"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"dateAssigned": "2026-11-07T21:44:36.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eGeneration of Error Message Containing Sensitive Information vulnerability in ash-project ash_ai allows a caller of an AshAi tool to read internal error details, including module names and data values, by making a tool call fail.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eAshAi.ToToolError\u003c/code\u003e gained an implementation for \u003ccode\u003eAsh.Error.Unknown.UnknownError\u003c/code\u003e that returns the error\u0027s \u003ccode\u003eerror\u003c/code\u003e field as is, and \u003ccode\u003eAshAi.Tool.Errors.format/1\u003c/code\u003e sends that text to MCP clients (tool calls and resource reads in \u003ccode\u003eAshAi.Mcp.Server\u003c/code\u003e) and to the model in \u003ccode\u003eAshAi.ToolLoop\u003c/code\u003e. Ash stores the full \u003ccode\u003eException.format/2\u003c/code\u003e output of a raised exception, or \u003ccode\u003einspect/1\u003c/code\u003e of a bare \u003ccode\u003e{:error, term}\u003c/code\u003e return, in that field. A tool result that cannot be JSON-encoded raises a \u003ccode\u003eProtocol.UndefinedError\u003c/code\u003e whose text includes the inspected value, which can be a whole record with fields the tool never returns. None of these errors were logged. The fix logs them under an error id and returns only that id to the caller.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_ai: from 1.5.0 before 1.5.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_ai allows a caller of an AshAi tool to read internal error details, including module names and data values, by making a tool call fail.\n\n`AshAi.ToToolError` gained an implementation for `Ash.Error.Unknown.UnknownError` that returns the error\u0027s `error` field as is, and `AshAi.Tool.Errors.format/1` sends that text to MCP clients (tool calls and resource reads in `AshAi.Mcp.Server`) and to the model in `AshAi.ToolLoop`. Ash stores the full `Exception.format/2` output of a raised exception, or `inspect/1` of a bare `{:error, term}` return, in that field. A tool result that cannot be JSON-encoded raises a `Protocol.UndefinedError` whose text includes the inspected value, which can be a whole record with fields the tool never returns. None of these errors were logged. The fix logs them under an error id and returns only that id to the caller.\n\nThis issue affects ash_ai: from 1.5.0 before 1.5.1."
}
],
"value": "Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_ai allows a caller of an AshAi tool to read internal error details, including module names and data values, by making a tool call fail.\n\nAshAi.ToToolError gained an implementation for Ash.Error.Unknown.UnknownError that returns the error\u0027s error field as is, and AshAi.Tool.Errors.format/1 sends that text to MCP clients (tool calls and resource reads in AshAi.Mcp.Server) and to the model in AshAi.ToolLoop. Ash stores the full Exception.format/2 output of a raised exception, or inspect/1 of a bare {:error, term} return, in that field. A tool result that cannot be JSON-encoded raises a Protocol.UndefinedError whose text includes the inspected value, which can be a whole record with fields the tool never returns. None of these errors were logged. The fix logs them under an error id and returns only that id to the caller.\n\nThis issue affects ash_ai: from 1.5.0 before 1.5.1."
}
],
"impacts": [
{
"capecId": "CAPEC-215",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA caller with tool access sends unexpected or malformed tool arguments until a tool fails, then reads the returned error text to learn internal module and function names and the values the code failed on.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "A caller with tool access sends unexpected or malformed tool arguments until a tool fails, then reads the returned error text to learn internal module and function names and the values the code failed on."
}
],
"value": "A caller with tool access sends unexpected or malformed tool arguments until a tool fails, then reads the returned error text to learn internal module and function names and the values the code failed on."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-209",
"description": "CWE-209 Generation of Error Message Containing Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T13:03:21.386Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "Information disclosure in `AshAi.ToToolError` in AshAi sends raw exception text to tool callers",
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash_ai/security/advisories/GHSA-vhmw-fwrr-r6c6"
},
{
"name": "EEF CNA record for CVE-2026-119613",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-119613.html"
},
{
"name": "OSV record EEF-CVE-2026-119613",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-119613"
},
{
"name": "Introducing commit fbad04e in ash-project/ash_ai",
"tags": [
"related"
],
"url": "https://github.com/ash-project/ash_ai/commit/fbad04e9620ef70603f4e67e03f15092f58578f6"
},
{
"name": "Fix commit af79877 in ash-project/ash_ai",
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_ai/commit/af7987769d78ed070c8a9f6e6ee542d91744eae6"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "AshAi sends unrecognized tool errors verbatim to MCP clients and the model, disclosing internal details"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-119613",
"datePublished": "2026-11-09T13:03:21.386Z",
"dateReserved": "2026-10-30T23:45:01.997Z",
"dateUpdated": "2026-11-12T16:11:19.623Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-96581 (GCVE-0-2026-96581)
Vulnerability from nvd – Published: 2026-10-26 07:20 – Updated: 2026-10-26 14:35
VLAI
EPSS
VEX
Title
An upsert on the primary key in Ash ignores attribute multitenancy, so one tenant can read, overwrite and take over another tenant's records
Summary
Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash allows a user of one tenant to read, overwrite and take over another tenant's records via an upserting create action.
Under attribute multitenancy, Ash.Actions.Create (lib/ash/actions/create/create.ex) and Ash.Actions.Create.Bulk (lib/ash/actions/create/bulk.ex) upserted on the primary key, or on an all_tenants? identity, without scoping the conflicting record to the request's tenant. A caller of a create action with upsert? true that accepts the primary key, supplying a record id from another tenant, updated that record's upsert fields and received all of its attributes in the result. With the default upsert fields the tenant attribute was written too, moving the record into the caller's tenant. Read and update policies do not run for upserts, and tenant-scoped create policies pass because the tenant is the caller's own.
This issue affects ash: from 1.22.0 before 3.37.2.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-26 14:25 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash/security/advis… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-96581.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-96581 | related |
| https://github.com/ash-project/ash/commit/2333d01… | related |
| https://github.com/ash-project/ash/commit/c9f0cdb… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash |
Affected:
1.22.0 , < 3.37.2
(semver)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
|
| ash-project | ash |
Affected:
2333d01ddf37e5909769a513059b27e3183331c5 , < c9f0cdb31e7c084def05f3f5be69dd7bb7721754
(git)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-96581",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-26T14:25:41.244972Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T14:35:19.745Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Actions.Create\u0027",
"\u0027Elixir.Ash.Actions.Create.Bulk\u0027",
"\u0027Elixir.Ash.DataLayer.Ets\u0027",
"\u0027Elixir.Ash.DataLayer.Mnesia\u0027"
],
"packageName": "ash",
"packageURL": "pkg:hex/ash",
"product": "ash",
"programFiles": [
"lib/ash/actions/create/create.ex",
"lib/ash/actions/create/bulk.ex",
"lib/ash/data_layer/ets/ets.ex",
"lib/ash/data_layer/mnesia/mnesia.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Actions.Create\u0027:run/4"
},
{
"name": "\u0027Elixir.Ash.Actions.Create.Bulk\u0027:run/5"
},
{
"name": "\u0027Elixir.Ash.DataLayer.Ets\u0027:upsert/4"
},
{
"name": "\u0027Elixir.Ash.DataLayer.Mnesia\u0027:upsert/4"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "3.37.2",
"status": "affected",
"version": "1.22.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Actions.Create\u0027",
"\u0027Elixir.Ash.Actions.Create.Bulk\u0027",
"\u0027Elixir.Ash.DataLayer.Ets\u0027",
"\u0027Elixir.Ash.DataLayer.Mnesia\u0027"
],
"packageName": "ash-project/ash",
"packageURL": "pkg:github/ash-project/ash",
"product": "ash",
"programFiles": [
"lib/ash/actions/create/create.ex",
"lib/ash/actions/create/bulk.ex",
"lib/ash/data_layer/ets/ets.ex",
"lib/ash/data_layer/mnesia/mnesia.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Actions.Create\u0027:run/4"
},
{
"name": "\u0027Elixir.Ash.Actions.Create.Bulk\u0027:run/5"
},
{
"name": "\u0027Elixir.Ash.DataLayer.Ets\u0027:upsert/4"
},
{
"name": "\u0027Elixir.Ash.DataLayer.Mnesia\u0027:upsert/4"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "c9f0cdb31e7c084def05f3f5be69dd7bb7721754",
"status": "affected",
"version": "2333d01ddf37e5909769a513059b27e3183331c5",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eReachable when a resource uses attribute multitenancy and exposes to callers of one tenant a create action with \u003ccode\u003eupsert? true\u003c/code\u003e that either upserts on the primary key (no \u003ccode\u003eupsert_identity\u003c/code\u003e) and accepts it, or upserts on an \u003ccode\u003eall_tenants?\u003c/code\u003e identity, and the caller knows or can enumerate a key belonging to another tenant (for example a serial integer id, or an id from a shared link or export).\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Reachable when a resource uses attribute multitenancy and exposes to callers of one tenant a create action with `upsert? true` that either upserts on the primary key (no `upsert_identity`) and accepts it, or upserts on an `all_tenants?` identity, and the caller knows or can enumerate a key belonging to another tenant (for example a serial integer id, or an id from a shared link or export)."
}
],
"value": "Reachable when a resource uses attribute multitenancy and exposes to callers of one tenant a create action with upsert? true that either upserts on the primary key (no upsert_identity) and accepts it, or upserts on an all_tenants? identity, and the caller knows or can enumerate a key belonging to another tenant (for example a serial integer id, or an id from a shared link or export)."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.37.2",
"versionStartIncluding": "1.22.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Will Townsend"
},
{
"lang": "en",
"type": "reporter",
"value": "Will Townsend"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
}
],
"dateAssigned": "2026-10-26T05:14:04.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAuthorization Bypass Through User-Controlled Key vulnerability in ash-project ash allows a user of one tenant to read, overwrite and take over another tenant\u0027s records via an upserting create action.\u003c/p\u003e\n\u003cp\u003eUnder attribute multitenancy, \u003ccode\u003eAsh.Actions.Create\u003c/code\u003e (\u003ccode\u003elib/ash/actions/create/create.ex\u003c/code\u003e) and \u003ccode\u003eAsh.Actions.Create.Bulk\u003c/code\u003e (\u003ccode\u003elib/ash/actions/create/bulk.ex\u003c/code\u003e) upserted on the primary key, or on an \u003ccode\u003eall_tenants?\u003c/code\u003e identity, without scoping the conflicting record to the request\u0027s tenant. A caller of a create action with \u003ccode\u003eupsert? true\u003c/code\u003e that accepts the primary key, supplying a record id from another tenant, updated that record\u0027s upsert fields and received all of its attributes in the result. With the default upsert fields the tenant attribute was written too, moving the record into the caller\u0027s tenant. Read and update policies do not run for upserts, and tenant-scoped create policies pass because the tenant is the caller\u0027s own.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash: from 1.22.0 before 3.37.2.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash allows a user of one tenant to read, overwrite and take over another tenant\u0027s records via an upserting create action.\n\nUnder attribute multitenancy, `Ash.Actions.Create` (`lib/ash/actions/create/create.ex`) and `Ash.Actions.Create.Bulk` (`lib/ash/actions/create/bulk.ex`) upserted on the primary key, or on an `all_tenants?` identity, without scoping the conflicting record to the request\u0027s tenant. A caller of a create action with `upsert? true` that accepts the primary key, supplying a record id from another tenant, updated that record\u0027s upsert fields and received all of its attributes in the result. With the default upsert fields the tenant attribute was written too, moving the record into the caller\u0027s tenant. Read and update policies do not run for upserts, and tenant-scoped create policies pass because the tenant is the caller\u0027s own.\n\nThis issue affects ash: from 1.22.0 before 3.37.2."
}
],
"value": "Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash allows a user of one tenant to read, overwrite and take over another tenant\u0027s records via an upserting create action.\n\nUnder attribute multitenancy, Ash.Actions.Create (lib/ash/actions/create/create.ex) and Ash.Actions.Create.Bulk (lib/ash/actions/create/bulk.ex) upserted on the primary key, or on an all_tenants? identity, without scoping the conflicting record to the request\u0027s tenant. A caller of a create action with upsert? true that accepts the primary key, supplying a record id from another tenant, updated that record\u0027s upsert fields and received all of its attributes in the result. With the default upsert fields the tenant attribute was written too, moving the record into the caller\u0027s tenant. Read and update policies do not run for upserts, and tenant-scoped create policies pass because the tenant is the caller\u0027s own.\n\nThis issue affects ash: from 1.22.0 before 3.37.2."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA signed-in user of one tenant posts another tenant\u0027s record id to an upserting create action, receives that record\u0027s attributes, overwrites its upsert fields, and with the default upsert fields moves it into their own tenant.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "A signed-in user of one tenant posts another tenant\u0027s record id to an upserting create action, receives that record\u0027s attributes, overwrites its upsert fields, and with the default upsert fields moves it into their own tenant."
}
],
"value": "A signed-in user of one tenant posts another tenant\u0027s record id to an upserting create action, receives that record\u0027s attributes, overwrites its upsert fields, and with the default upsert fields moves it into their own tenant."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T07:20:07.186Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "An upsert on the primary key in Ash ignores attribute multitenancy, so one tenant can read, overwrite and take over another tenant\u0027s records",
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-vw7c-67pf-gh96"
},
{
"name": "EEF CNA record for CVE-2026-96581",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-96581.html"
},
{
"name": "OSV record EEF-CVE-2026-96581",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-96581"
},
{
"name": "Introducing commit 2333d01 in ash-project/ash",
"tags": [
"related"
],
"url": "https://github.com/ash-project/ash/commit/2333d01ddf37e5909769a513059b27e3183331c5"
},
{
"name": "Fix commit c9f0cdb in ash-project/ash",
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash/commit/c9f0cdb31e7c084def05f3f5be69dd7bb7721754"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "An upsert on the primary key in Ash ignores attribute multitenancy, so one tenant can read, overwrite and take over another tenant\u0027s records",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAdd \u003ccode\u003eupsert_condition expr(\u0026lt;tenant attribute\u0026gt; == ^tenant())\u003c/code\u003e to every create action that upserts on the primary key or on an \u003ccode\u003eall_tenants?\u003c/code\u003e identity, and do not combine it with \u003ccode\u003ereturn_skipped_upsert?\u003c/code\u003e. An upsert into another tenant\u0027s record then fails with \u003ccode\u003eAsh.Error.Changes.StaleRecord\u003c/code\u003e (or is skipped in a bulk create) and leaves that record unchanged. This does not help on the Mnesia data layer, which ignores upsert conditions in affected versions.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Add `upsert_condition expr(\u003ctenant attribute\u003e == ^tenant())` to every create action that upserts on the primary key or on an `all_tenants?` identity, and do not combine it with `return_skipped_upsert?`. An upsert into another tenant\u0027s record then fails with `Ash.Error.Changes.StaleRecord` (or is skipped in a bulk create) and leaves that record unchanged. This does not help on the Mnesia data layer, which ignores upsert conditions in affected versions."
}
],
"value": "Add upsert_condition expr(\u003ctenant attribute\u003e == ^tenant()) to every create action that upserts on the primary key or on an all_tenants? identity, and do not combine it with return_skipped_upsert?. An upsert into another tenant\u0027s record then fails with Ash.Error.Changes.StaleRecord (or is skipped in a bulk create) and leaves that record unchanged. This does not help on the Mnesia data layer, which ignores upsert conditions in affected versions."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-96581",
"datePublished": "2026-10-26T07:20:07.186Z",
"dateReserved": "2026-10-25T17:30:02.206Z",
"dateUpdated": "2026-10-26T14:35:19.745Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-115635 (GCVE-0-2026-115635)
Vulnerability from nvd – Published: 2026-10-25 19:48 – Updated: 2026-10-26 14:35
VLAI
EPSS
VEX
Title
AshPostgres returns another tenant's record for a skipped upsert when return_skipped_upsert? is set
Summary
Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to read another tenant's record through a skipped upsert.
When Ash.bulk_create/4 or a single create runs as an upsert with return_skipped_upsert?: true and the upsert is skipped (for example because its upsert_condition does not hold), AshPostgres.DataLayer reads the existing row back by the upsert identity in do_bulk_create/3 and upsert/4. That lookup did not apply the resource's attribute multitenancy, so on a resource using strategy :attribute it could match and return the row of another tenant with the same identity values, exposing its fields to the caller.
This issue affects ash_postgres: from 2.6.22 before 2.15.2.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-26 14:29 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash/security/advis… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-115635.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-115635 | related |
| https://github.com/ash-project/ash_postgres/commi… | related |
| https://github.com/ash-project/ash_postgres/commi… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_postgres |
Affected:
2.6.22 , < 2.15.2
(semver)
cpe:2.3:a:ash-project:ash_postgres:*:*:*:*:*:*:*:* |
|
| ash-project | ash_postgres |
Affected:
af0903f1380468bbe1b61fe65acb33772b5e24a5 , < 8aa81220c401cae412d21078d11b3519ea25d3a9
(git)
cpe:2.3:a:ash-project:ash_postgres:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-115635",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-26T14:29:19.217057Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T14:35:21.261Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_postgres:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshPostgres.DataLayer\u0027"
],
"packageName": "ash_postgres",
"packageURL": "pkg:hex/ash_postgres",
"product": "ash_postgres",
"programFiles": [
"lib/data_layer.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshPostgres.DataLayer\u0027:do_bulk_create/3"
},
{
"name": "\u0027Elixir.AshPostgres.DataLayer\u0027:upsert/4"
},
{
"name": "\u0027Elixir.AshPostgres.DataLayer\u0027:bulk_create/3"
}
],
"repo": "https://github.com/ash-project/ash_postgres",
"vendor": "ash-project",
"versions": [
{
"lessThan": "2.15.2",
"status": "affected",
"version": "2.6.22",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_postgres:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshPostgres.DataLayer\u0027"
],
"packageName": "ash-project/ash_postgres",
"packageURL": "pkg:github/ash-project/ash_postgres",
"product": "ash_postgres",
"programFiles": [
"lib/data_layer.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshPostgres.DataLayer\u0027:do_bulk_create/3"
},
{
"name": "\u0027Elixir.AshPostgres.DataLayer\u0027:upsert/4"
},
{
"name": "\u0027Elixir.AshPostgres.DataLayer\u0027:bulk_create/3"
}
],
"repo": "https://github.com/ash-project/ash_postgres",
"vendor": "ash-project",
"versions": [
{
"lessThan": "8aa81220c401cae412d21078d11b3519ea25d3a9",
"status": "affected",
"version": "af0903f1380468bbe1b61fe65acb33772b5e24a5",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eReachable when a resource uses attribute multitenancy, an action performs upserts with \u003ccode\u003ereturn_skipped_upsert?: true\u003c/code\u003e, and a caller can supply identity values that another tenant also uses.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Reachable when a resource uses attribute multitenancy, an action performs upserts with `return_skipped_upsert?: true`, and a caller can supply identity values that another tenant also uses."
}
],
"value": "Reachable when a resource uses attribute multitenancy, an action performs upserts with return_skipped_upsert?: true, and a caller can supply identity values that another tenant also uses."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_postgres:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.15.2",
"versionStartIncluding": "2.6.22",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Will Townsend"
},
{
"lang": "en",
"type": "reporter",
"value": "Will Townsend"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
}
],
"dateAssigned": "2026-10-25T17:27:42.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIncorrect Authorization vulnerability in ash-project ash_postgres allows a user to read another tenant\u0027s record through a skipped upsert.\u003c/p\u003e\n\u003cp\u003eWhen \u003ccode\u003eAsh.bulk_create/4\u003c/code\u003e or a single create runs as an upsert with \u003ccode\u003ereturn_skipped_upsert?: true\u003c/code\u003e and the upsert is skipped (for example because its \u003ccode\u003eupsert_condition\u003c/code\u003e does not hold), \u003ccode\u003eAshPostgres.DataLayer\u003c/code\u003e reads the existing row back by the upsert identity in \u003ccode\u003edo_bulk_create/3\u003c/code\u003e and \u003ccode\u003eupsert/4\u003c/code\u003e. That lookup did not apply the resource\u0027s attribute multitenancy, so on a resource using \u003ccode\u003estrategy :attribute\u003c/code\u003e it could match and return the row of another tenant with the same identity values, exposing its fields to the caller.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_postgres: from 2.6.22 before 2.15.2.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to read another tenant\u0027s record through a skipped upsert.\n\nWhen `Ash.bulk_create/4` or a single create runs as an upsert with `return_skipped_upsert?: true` and the upsert is skipped (for example because its `upsert_condition` does not hold), `AshPostgres.DataLayer` reads the existing row back by the upsert identity in `do_bulk_create/3` and `upsert/4`. That lookup did not apply the resource\u0027s attribute multitenancy, so on a resource using `strategy :attribute` it could match and return the row of another tenant with the same identity values, exposing its fields to the caller.\n\nThis issue affects ash_postgres: from 2.6.22 before 2.15.2."
}
],
"value": "Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to read another tenant\u0027s record through a skipped upsert.\n\nWhen Ash.bulk_create/4 or a single create runs as an upsert with return_skipped_upsert?: true and the upsert is skipped (for example because its upsert_condition does not hold), AshPostgres.DataLayer reads the existing row back by the upsert identity in do_bulk_create/3 and upsert/4. That lookup did not apply the resource\u0027s attribute multitenancy, so on a resource using strategy :attribute it could match and return the row of another tenant with the same identity values, exposing its fields to the caller.\n\nThis issue affects ash_postgres: from 2.6.22 before 2.15.2."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA user of one tenant whose upsert is skipped receives another tenant\u0027s record with the same identity values.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "A user of one tenant whose upsert is skipped receives another tenant\u0027s record with the same identity values."
}
],
"value": "A user of one tenant whose upsert is skipped receives another tenant\u0027s record with the same identity values."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-25T19:48:43.829Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "`Ash.bulk_create` with `return_skipped_upsert?: true` in AshPostgres returns another tenant\u0027s record for a skipped upsert",
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-36hg-wwp2-fg8w"
},
{
"name": "EEF CNA record for CVE-2026-115635",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-115635.html"
},
{
"name": "OSV record EEF-CVE-2026-115635",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-115635"
},
{
"name": "Introducing commit af0903f in ash-project/ash_postgres",
"tags": [
"related"
],
"url": "https://github.com/ash-project/ash_postgres/commit/af0903f1380468bbe1b61fe65acb33772b5e24a5"
},
{
"name": "Fix commit 8aa8122 in ash-project/ash_postgres",
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_postgres/commit/8aa81220c401cae412d21078d11b3519ea25d3a9"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "AshPostgres returns another tenant\u0027s record for a skipped upsert when return_skipped_upsert? is set"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-115635",
"datePublished": "2026-10-25T19:48:43.829Z",
"dateReserved": "2026-10-23T13:00:02.145Z",
"dateUpdated": "2026-10-26T14:35:21.261Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-115627 (GCVE-0-2026-115627)
Vulnerability from nvd – Published: 2026-10-25 19:49 – Updated: 2026-10-26 14:35
VLAI
EPSS
VEX
Title
AshPostgres ignores attribute multitenancy on the join resource when loading many_to_many and through relationships, returning records related through other tenants' rows
Summary
Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to load destination records linked to a source record only through another tenant's join rows.
When a many_to_many relationship, or a through relationship, is loaded with a lateral join (for example with a per-record limit or sort), AshPostgres.DataLayer builds the query for the join resource, and for each resource along a through path, in lateral_join_query/3 and through_step_queries/4 without running that resource's read action, which is where attribute multitenancy is applied. When those resources use strategy :attribute multitenancy, rows belonging to other tenants were joined, so the load returned destination records that the caller's tenant is not related to.
This issue affects ash_postgres: from 0.38.0 before 2.15.2.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-26 14:27 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash/security/advis… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-115627.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-115627 | related |
| https://github.com/ash-project/ash_postgres/commi… | related |
| https://github.com/ash-project/ash_postgres/commi… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_postgres |
Affected:
0.38.0 , < 2.15.2
(semver)
cpe:2.3:a:ash-project:ash_postgres:*:*:*:*:*:*:*:* |
|
| ash-project | ash_postgres |
Affected:
7115bec58678f13b1ac2fb4822a0ba1aea9dbec5 , < 8c25c945c39a45299193fe70b09fc2fa2aacac7b
(git)
cpe:2.3:a:ash-project:ash_postgres:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-115627",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-26T14:27:42.624297Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T14:35:21.109Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_postgres:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshPostgres.DataLayer\u0027"
],
"packageName": "ash_postgres",
"packageURL": "pkg:hex/ash_postgres",
"product": "ash_postgres",
"programFiles": [
"lib/data_layer.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshPostgres.DataLayer\u0027:lateral_join_query/3"
},
{
"name": "\u0027Elixir.AshPostgres.DataLayer\u0027:through_step_queries/4"
},
{
"name": "\u0027Elixir.AshPostgres.DataLayer\u0027:run_query_with_lateral_join/4"
}
],
"repo": "https://github.com/ash-project/ash_postgres",
"vendor": "ash-project",
"versions": [
{
"lessThan": "2.15.2",
"status": "affected",
"version": "0.38.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_postgres:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshPostgres.DataLayer\u0027"
],
"packageName": "ash-project/ash_postgres",
"packageURL": "pkg:github/ash-project/ash_postgres",
"product": "ash_postgres",
"programFiles": [
"lib/data_layer.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshPostgres.DataLayer\u0027:lateral_join_query/3"
},
{
"name": "\u0027Elixir.AshPostgres.DataLayer\u0027:through_step_queries/4"
},
{
"name": "\u0027Elixir.AshPostgres.DataLayer\u0027:run_query_with_lateral_join/4"
}
],
"repo": "https://github.com/ash-project/ash_postgres",
"vendor": "ash-project",
"versions": [
{
"lessThan": "8c25c945c39a45299193fe70b09fc2fa2aacac7b",
"status": "affected",
"version": "7115bec58678f13b1ac2fb4822a0ba1aea9dbec5",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eReachable when the join resource of a \u003ccode\u003emany_to_many\u003c/code\u003e relationship, or a resource along a \u003ccode\u003ethrough\u003c/code\u003e path, uses attribute multitenancy and holds rows from several tenants, and the relationship is loaded with a lateral join (for example with a limit, offset or sort on the relationship).\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Reachable when the join resource of a `many_to_many` relationship, or a resource along a `through` path, uses attribute multitenancy and holds rows from several tenants, and the relationship is loaded with a lateral join (for example with a limit, offset or sort on the relationship)."
}
],
"value": "Reachable when the join resource of a many_to_many relationship, or a resource along a through path, uses attribute multitenancy and holds rows from several tenants, and the relationship is loaded with a lateral join (for example with a limit, offset or sort on the relationship)."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_postgres:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.15.2",
"versionStartIncluding": "0.38.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Will Townsend"
},
{
"lang": "en",
"type": "reporter",
"value": "Will Townsend"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
}
],
"dateAssigned": "2026-10-25T17:27:14.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIncorrect Authorization vulnerability in ash-project ash_postgres allows a user to load destination records linked to a source record only through another tenant\u0027s join rows.\u003c/p\u003e\n\u003cp\u003eWhen a \u003ccode\u003emany_to_many\u003c/code\u003e relationship, or a \u003ccode\u003ethrough\u003c/code\u003e relationship, is loaded with a lateral join (for example with a per-record limit or sort), \u003ccode\u003eAshPostgres.DataLayer\u003c/code\u003e builds the query for the join resource, and for each resource along a \u003ccode\u003ethrough\u003c/code\u003e path, in \u003ccode\u003elateral_join_query/3\u003c/code\u003e and \u003ccode\u003ethrough_step_queries/4\u003c/code\u003e without running that resource\u0027s read action, which is where attribute multitenancy is applied. When those resources use \u003ccode\u003estrategy :attribute\u003c/code\u003e multitenancy, rows belonging to other tenants were joined, so the load returned destination records that the caller\u0027s tenant is not related to.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_postgres: from 0.38.0 before 2.15.2.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to load destination records linked to a source record only through another tenant\u0027s join rows.\n\nWhen a `many_to_many` relationship, or a `through` relationship, is loaded with a lateral join (for example with a per-record limit or sort), `AshPostgres.DataLayer` builds the query for the join resource, and for each resource along a `through` path, in `lateral_join_query/3` and `through_step_queries/4` without running that resource\u0027s read action, which is where attribute multitenancy is applied. When those resources use `strategy :attribute` multitenancy, rows belonging to other tenants were joined, so the load returned destination records that the caller\u0027s tenant is not related to.\n\nThis issue affects ash_postgres: from 0.38.0 before 2.15.2."
}
],
"value": "Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to load destination records linked to a source record only through another tenant\u0027s join rows.\n\nWhen a many_to_many relationship, or a through relationship, is loaded with a lateral join (for example with a per-record limit or sort), AshPostgres.DataLayer builds the query for the join resource, and for each resource along a through path, in lateral_join_query/3 and through_step_queries/4 without running that resource\u0027s read action, which is where attribute multitenancy is applied. When those resources use strategy :attribute multitenancy, rows belonging to other tenants were joined, so the load returned destination records that the caller\u0027s tenant is not related to.\n\nThis issue affects ash_postgres: from 0.38.0 before 2.15.2."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA user of one tenant loading a many_to_many or through relationship receives destination records linked only through another tenant\u0027s join rows.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "A user of one tenant loading a many_to_many or through relationship receives destination records linked only through another tenant\u0027s join rows."
}
],
"value": "A user of one tenant loading a many_to_many or through relationship receives destination records linked only through another tenant\u0027s join rows."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-25T19:49:50.510Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "AshPostgres ignores attribute multitenancy on the join resource when loading `many_to_many` and `through` relationships, returning records related through other tenants\u0027 rows",
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-gr2r-f49c-9gm2"
},
{
"name": "EEF CNA record for CVE-2026-115627",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-115627.html"
},
{
"name": "OSV record EEF-CVE-2026-115627",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-115627"
},
{
"name": "Introducing commit 7115bec in ash-project/ash_postgres",
"tags": [
"related"
],
"url": "https://github.com/ash-project/ash_postgres/commit/7115bec58678f13b1ac2fb4822a0ba1aea9dbec5"
},
{
"name": "Fix commit 8c25c94 in ash-project/ash_postgres",
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_postgres/commit/8c25c945c39a45299193fe70b09fc2fa2aacac7b"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "AshPostgres ignores attribute multitenancy on the join resource when loading many_to_many and through relationships, returning records related through other tenants\u0027 rows"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-115627",
"datePublished": "2026-10-25T19:49:50.510Z",
"dateReserved": "2026-10-23T13:00:02.154Z",
"dateUpdated": "2026-10-26T14:35:21.109Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114214 (GCVE-0-2026-114214)
Vulnerability from nvd – Published: 2026-10-25 19:47 – Updated: 2026-10-26 14:35
VLAI
EPSS
VEX
Title
Loading a through relationship with a limit of 1 in Ash ignores the through path and returns unrelated destination records
Summary
Incorrect Authorization vulnerability in ash-project ash allows a client to read destination records unrelated to the source record through a through relationship.
When a has_many relationship declared with through: was loaded for a single record with a limit of 1, or an unsorted has_one through relationship was loaded with a limit of 1, lateral_join?/4 in lib/ash/actions/read/relationships.ex chose the path that reads the destination without any filter linking it to the source. The load returned the first destination record by sort, or any other record with an offset. The read still runs the destination's policies but carries the relationship as accessing_from, so a client paging such a field (for example teachers(limit: 1, offset: n) through AshGraphql) can enumerate destination records that policies allow only when reached through that relationship.
This issue affects ash: from 3.24.0 before 3.37.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-26 14:28 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash/security/advis… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-114214.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-114214 | related |
| https://github.com/ash-project/ash/commit/24f41e2… | related |
| https://github.com/ash-project/ash/commit/e374633… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash |
Affected:
3.24.0 , < 3.37.1
(semver)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
|
| ash-project | ash |
Affected:
24f41e23dcbd9d07cde270a8141490e8f79251f5 , < e37463307304b26bc8fd606322e5c4d8f7f060e5
(git)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-114214",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-26T14:28:34.411522Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T14:35:21.414Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Actions.Read.Relationships\u0027"
],
"packageName": "ash",
"packageURL": "pkg:hex/ash",
"product": "ash",
"programFiles": [
"lib/ash/actions/read/relationships.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Actions.Read.Relationships\u0027:lateral_join?/4"
},
{
"name": "\u0027Elixir.Ash.Actions.Read.Relationships\u0027:load/4"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "3.37.1",
"status": "affected",
"version": "3.24.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Actions.Read.Relationships\u0027"
],
"packageName": "ash-project/ash",
"packageURL": "pkg:github/ash-project/ash",
"product": "ash",
"programFiles": [
"lib/ash/actions/read/relationships.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Actions.Read.Relationships\u0027:lateral_join?/4"
},
{
"name": "\u0027Elixir.Ash.Actions.Read.Relationships\u0027:load/4"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "e37463307304b26bc8fd606322e5c4d8f7f060e5",
"status": "affected",
"version": "24f41e23dcbd9d07cde270a8141490e8f79251f5",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eReachable when a \u003ccode\u003ethrough\u003c/code\u003e relationship is loaded for a single record with a caller-controlled limit of 1 (and optionally an offset), for example through AshGraphql relationship field arguments, and the destination resource\u0027s read policies rely on the relationship (\u003ccode\u003eaccessing_from\u003c/code\u003e) or are otherwise open to the caller.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Reachable when a `through` relationship is loaded for a single record with a caller-controlled limit of 1 (and optionally an offset), for example through AshGraphql relationship field arguments, and the destination resource\u0027s read policies rely on the relationship (`accessing_from`) or are otherwise open to the caller."
}
],
"value": "Reachable when a through relationship is loaded for a single record with a caller-controlled limit of 1 (and optionally an offset), for example through AshGraphql relationship field arguments, and the destination resource\u0027s read policies rely on the relationship (accessing_from) or are otherwise open to the caller."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.37.1",
"versionStartIncluding": "3.24.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Will Townsend"
},
{
"lang": "en",
"type": "reporter",
"value": "Will Townsend"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
}
],
"dateAssigned": "2026-10-25T17:24:26.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIncorrect Authorization vulnerability in ash-project ash allows a client to read destination records unrelated to the source record through a \u003ccode\u003ethrough\u003c/code\u003e relationship.\u003c/p\u003e\n\u003cp\u003eWhen a \u003ccode\u003ehas_many\u003c/code\u003e relationship declared with \u003ccode\u003ethrough:\u003c/code\u003e was loaded for a single record with a limit of 1, or an unsorted \u003ccode\u003ehas_one\u003c/code\u003e \u003ccode\u003ethrough\u003c/code\u003e relationship was loaded with a limit of 1, \u003ccode\u003elateral_join?/4\u003c/code\u003e in \u003ccode\u003elib/ash/actions/read/relationships.ex\u003c/code\u003e chose the path that reads the destination without any filter linking it to the source. The load returned the first destination record by sort, or any other record with an \u003ccode\u003eoffset\u003c/code\u003e. The read still runs the destination\u0027s policies but carries the relationship as \u003ccode\u003eaccessing_from\u003c/code\u003e, so a client paging such a field (for example \u003ccode\u003eteachers(limit: 1, offset: n)\u003c/code\u003e through AshGraphql) can enumerate destination records that policies allow only when reached through that relationship.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash: from 3.24.0 before 3.37.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Incorrect Authorization vulnerability in ash-project ash allows a client to read destination records unrelated to the source record through a `through` relationship.\n\nWhen a `has_many` relationship declared with `through:` was loaded for a single record with a limit of 1, or an unsorted `has_one` `through` relationship was loaded with a limit of 1, `lateral_join?/4` in `lib/ash/actions/read/relationships.ex` chose the path that reads the destination without any filter linking it to the source. The load returned the first destination record by sort, or any other record with an `offset`. The read still runs the destination\u0027s policies but carries the relationship as `accessing_from`, so a client paging such a field (for example `teachers(limit: 1, offset: n)` through AshGraphql) can enumerate destination records that policies allow only when reached through that relationship.\n\nThis issue affects ash: from 3.24.0 before 3.37.1."
}
],
"value": "Incorrect Authorization vulnerability in ash-project ash allows a client to read destination records unrelated to the source record through a through relationship.\n\nWhen a has_many relationship declared with through: was loaded for a single record with a limit of 1, or an unsorted has_one through relationship was loaded with a limit of 1, lateral_join?/4 in lib/ash/actions/read/relationships.ex chose the path that reads the destination without any filter linking it to the source. The load returned the first destination record by sort, or any other record with an offset. The read still runs the destination\u0027s policies but carries the relationship as accessing_from, so a client paging such a field (for example teachers(limit: 1, offset: n) through AshGraphql) can enumerate destination records that policies allow only when reached through that relationship.\n\nThis issue affects ash: from 3.24.0 before 3.37.1."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA client paging a through relationship field with a limit of 1 reads destination records that should only be reachable through that relationship.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "A client paging a through relationship field with a limit of 1 reads destination records that should only be reachable through that relationship."
}
],
"value": "A client paging a through relationship field with a limit of 1 reads destination records that should only be reachable through that relationship."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-25T19:47:30.612Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "Loading a `through` relationship on a single record with `limit: 1` ignores the through path and returns arbitrary destination records",
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-g2h4-xp57-q863"
},
{
"name": "EEF CNA record for CVE-2026-114214",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-114214.html"
},
{
"name": "OSV record EEF-CVE-2026-114214",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-114214"
},
{
"name": "Introducing commit 24f41e2 in ash-project/ash",
"tags": [
"related"
],
"url": "https://github.com/ash-project/ash/commit/24f41e23dcbd9d07cde270a8141490e8f79251f5"
},
{
"name": "Fix commit e374633 in ash-project/ash",
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash/commit/e37463307304b26bc8fd606322e5c4d8f7f060e5"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Loading a through relationship with a limit of 1 in Ash ignores the through path and returns unrelated destination records"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-114214",
"datePublished": "2026-10-25T19:47:30.612Z",
"dateReserved": "2026-10-25T14:30:01.870Z",
"dateUpdated": "2026-10-26T14:35:21.414Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105283 (GCVE-0-2026-105283)
Vulnerability from nvd – Published: 2026-10-12 11:16 – Updated: 2026-10-16 16:53
VLAI
EPSS
VEX
Title
Internal error terms inspected into AshTypescript RPC error responses
Summary
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_typescript allows an unauthenticated attacker to read internal Elixir terms from an RPC error response by provoking an error the error builder has no dedicated clause for.
AshTypescript.Rpc.ErrorBuilder.build_error_response/1 in lib/ash_typescript/rpc/error_builder.ex renders a pipeline error term that matches no specific clause with inspect/1 and places the result in details.error of the client-facing error. Ash exceptions take a separate path in AshTypescript.Rpc.Errors where unhandled cases are redacted behind an errorId, but these fallbacks have no redaction, so whatever the term carries reaches the HTTP or channel response. Two request paths hand it such terms: a struct-typed action argument with an invalid nested value, where cast_map_to_struct/2 in lib/ash_typescript/rpc/input_formatter.ex throws the raw Ash.Type cast error into the builder, and field selection on a generic action that returns a primitive, where format_field_type/1 inspects the full Ash.Info.Manifest.Type struct into vars.returnType. Resource module names in vars.resource are not treated as sensitive and are out of scope.
This issue affects ash_typescript: from 0.1.0 before 0.19.1.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 16:50 UTC
CWE
- CWE-209 - Generation of Error Message Containing Sensitive Information
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash_typescript/sec… | relatedvendor-advisory |
| https://cna.erlef.org/cves/CVE-2026-105283.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-105283 | related |
| https://github.com/ash-project/ash_typescript/com… | related |
| https://github.com/ash-project/ash_typescript/com… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_typescript |
Affected:
0.1.0 , < 0.19.1
(semver)
cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:* |
|
| ash-project | ash_typescript |
Affected:
8e204ce34e24a158cf22a2dac4d53c44716c9e30 , < 4b3c65203ee78dc992d6d2e6559625c5460a01cd
(git)
cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105283",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T16:50:44.234803Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T16:53:18.072Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ash-project/ash_typescript/security/advisories/GHSA-7gxc-w225-f7f3"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshTypescript.Rpc.ErrorBuilder\u0027",
"\u0027Elixir.AshTypescript.Rpc.InputFormatter\u0027",
"\u0027Elixir.AshTypescript.Rpc\u0027"
],
"packageName": "ash_typescript",
"packageURL": "pkg:hex/ash_typescript",
"product": "ash_typescript",
"programFiles": [
"lib/ash_typescript/rpc/error_builder.ex",
"lib/ash_typescript/rpc/input_formatter.ex",
"lib/ash_typescript/rpc.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshTypescript.Rpc.ErrorBuilder\u0027:build_error_response/1"
},
{
"name": "\u0027Elixir.AshTypescript.Rpc.ErrorBuilder\u0027:format_field_type/1"
},
{
"name": "\u0027Elixir.AshTypescript.Rpc.InputFormatter\u0027:cast_map_to_struct/2"
},
{
"name": "\u0027Elixir.AshTypescript.Rpc\u0027:run_action/3"
},
{
"name": "\u0027Elixir.AshTypescript.Rpc\u0027:validate_action/3"
}
],
"repo": "https://github.com/ash-project/ash_typescript",
"vendor": "ash-project",
"versions": [
{
"lessThan": "0.19.1",
"status": "affected",
"version": "0.1.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshTypescript.Rpc.ErrorBuilder\u0027",
"\u0027Elixir.AshTypescript.Rpc.InputFormatter\u0027",
"\u0027Elixir.AshTypescript.Rpc\u0027"
],
"packageName": "ash-project/ash_typescript",
"packageURL": "pkg:github/ash-project/ash_typescript",
"product": "ash_typescript",
"programFiles": [
"lib/ash_typescript/rpc/error_builder.ex",
"lib/ash_typescript/rpc/input_formatter.ex",
"lib/ash_typescript/rpc.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshTypescript.Rpc.ErrorBuilder\u0027:build_error_response/1"
},
{
"name": "\u0027Elixir.AshTypescript.Rpc.ErrorBuilder\u0027:format_field_type/1"
},
{
"name": "\u0027Elixir.AshTypescript.Rpc.InputFormatter\u0027:cast_map_to_struct/2"
},
{
"name": "\u0027Elixir.AshTypescript.Rpc\u0027:run_action/3"
},
{
"name": "\u0027Elixir.AshTypescript.Rpc\u0027:validate_action/3"
}
],
"repo": "https://github.com/ash-project/ash_typescript",
"vendor": "ash-project",
"versions": [
{
"lessThan": "4b3c65203ee78dc992d6d2e6559625c5460a01cd",
"status": "affected",
"version": "8e204ce34e24a158cf22a2dac4d53c44716c9e30",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe application exposes an AshTypescript RPC endpoint over HTTP or a channel and has an action with a struct-typed argument, or a generic action with a primitive return type that accepts field selection.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "The application exposes an AshTypescript RPC endpoint over HTTP or a channel and has an action with a struct-typed argument, or a generic action with a primitive return type that accepts field selection."
}
],
"value": "The application exposes an AshTypescript RPC endpoint over HTTP or a channel and has an action with a struct-typed argument, or a generic action with a primitive return type that accepts field selection."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.19.1",
"versionStartIncluding": "0.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Shoukry / Udin"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Shoukry / Udin"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Torkild Gundersen Kjevik / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"dateAssigned": "2026-10-12T09:59:25.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eGeneration of Error Message Containing Sensitive Information vulnerability in ash-project ash_typescript allows an unauthenticated attacker to read internal Elixir terms from an RPC error response by provoking an error the error builder has no dedicated clause for.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eAshTypescript.Rpc.ErrorBuilder.build_error_response/1\u003c/code\u003e in \u003ccode\u003elib/ash_typescript/rpc/error_builder.ex\u003c/code\u003e renders a pipeline error term that matches no specific clause with \u003ccode\u003einspect/1\u003c/code\u003e and places the result in \u003ccode\u003edetails.error\u003c/code\u003e of the client-facing error. Ash exceptions take a separate path in \u003ccode\u003eAshTypescript.Rpc.Errors\u003c/code\u003e where unhandled cases are redacted behind an \u003ccode\u003eerrorId\u003c/code\u003e, but these fallbacks have no redaction, so whatever the term carries reaches the HTTP or channel response. Two request paths hand it such terms: a struct-typed action argument with an invalid nested value, where \u003ccode\u003ecast_map_to_struct/2\u003c/code\u003e in \u003ccode\u003elib/ash_typescript/rpc/input_formatter.ex\u003c/code\u003e throws the raw \u003ccode\u003eAsh.Type\u003c/code\u003e cast error into the builder, and field selection on a generic action that returns a primitive, where \u003ccode\u003eformat_field_type/1\u003c/code\u003e inspects the full \u003ccode\u003eAsh.Info.Manifest.Type\u003c/code\u003e struct into \u003ccode\u003evars.returnType\u003c/code\u003e. Resource module names in \u003ccode\u003evars.resource\u003c/code\u003e are not treated as sensitive and are out of scope.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_typescript: from 0.1.0 before 0.19.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_typescript allows an unauthenticated attacker to read internal Elixir terms from an RPC error response by provoking an error the error builder has no dedicated clause for.\n\n`AshTypescript.Rpc.ErrorBuilder.build_error_response/1` in `lib/ash_typescript/rpc/error_builder.ex` renders a pipeline error term that matches no specific clause with `inspect/1` and places the result in `details.error` of the client-facing error. Ash exceptions take a separate path in `AshTypescript.Rpc.Errors` where unhandled cases are redacted behind an `errorId`, but these fallbacks have no redaction, so whatever the term carries reaches the HTTP or channel response. Two request paths hand it such terms: a struct-typed action argument with an invalid nested value, where `cast_map_to_struct/2` in `lib/ash_typescript/rpc/input_formatter.ex` throws the raw `Ash.Type` cast error into the builder, and field selection on a generic action that returns a primitive, where `format_field_type/1` inspects the full `Ash.Info.Manifest.Type` struct into `vars.returnType`. Resource module names in `vars.resource` are not treated as sensitive and are out of scope.\n\nThis issue affects ash_typescript: from 0.1.0 before 0.19.1."
}
],
"value": "Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_typescript allows an unauthenticated attacker to read internal Elixir terms from an RPC error response by provoking an error the error builder has no dedicated clause for.\n\nAshTypescript.Rpc.ErrorBuilder.build_error_response/1 in lib/ash_typescript/rpc/error_builder.ex renders a pipeline error term that matches no specific clause with inspect/1 and places the result in details.error of the client-facing error. Ash exceptions take a separate path in AshTypescript.Rpc.Errors where unhandled cases are redacted behind an errorId, but these fallbacks have no redaction, so whatever the term carries reaches the HTTP or channel response. Two request paths hand it such terms: a struct-typed action argument with an invalid nested value, where cast_map_to_struct/2 in lib/ash_typescript/rpc/input_formatter.ex throws the raw Ash.Type cast error into the builder, and field selection on a generic action that returns a primitive, where format_field_type/1 inspects the full Ash.Info.Manifest.Type struct into vars.returnType. Resource module names in vars.resource are not treated as sensitive and are out of scope.\n\nThis issue affects ash_typescript: from 0.1.0 before 0.19.1."
}
],
"impacts": [
{
"capecId": "CAPEC-54",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAny client able to call the RPC endpoint can submit malformed struct arguments or field selections and read internal Elixir terms, including any state the failing pipeline step carried, from the error response.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Any client able to call the RPC endpoint can submit malformed struct arguments or field selections and read internal Elixir terms, including any state the failing pipeline step carried, from the error response."
}
],
"value": "Any client able to call the RPC endpoint can submit malformed struct arguments or field selections and read internal Elixir terms, including any state the failing pipeline step carried, from the error response."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-209",
"description": "CWE-209 Generation of Error Message Containing Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T11:16:30.582Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "GitHub Advisory",
"tags": [
"related",
"vendor-advisory"
],
"url": "https://github.com/ash-project/ash_typescript/security/advisories/GHSA-7gxc-w225-f7f3"
},
{
"name": "EEF CNA record for CVE-2026-105283",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-105283.html"
},
{
"name": "OSV record EEF-CVE-2026-105283",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-105283"
},
{
"name": "Introducing commit 8e204ce in ash-project/ash_typescript",
"tags": [
"related"
],
"url": "https://github.com/ash-project/ash_typescript/commit/8e204ce34e24a158cf22a2dac4d53c44716c9e30"
},
{
"name": "Fix commit 4b3c652 in ash-project/ash_typescript",
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_typescript/commit/4b3c65203ee78dc992d6d2e6559625c5460a01cd"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Internal error terms inspected into AshTypescript RPC error responses",
"x_proofOfConcept": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003col\u003e\n\u003cli\u003eExpose an AshTypescript RPC action that takes a struct-typed argument, for example an \u003ccode\u003eassignee\u003c/code\u003e argument whose struct has a UUID \u003ccode\u003eid\u003c/code\u003e field.\u003c/li\u003e\n\u003cli\u003eSend the action request with an invalid nested value, such as \u003ccode\u003e{\"assignee\": {\"id\": \"not-a-uuid\", \"name\": \"x\", \"email\": \"e\"}}\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eRead the response: each pair of the raw \u003ccode\u003eAsh.Type\u003c/code\u003e cast error is returned as its own \u003ccode\u003efield_validation_error\u003c/code\u003e with the inspected term in \u003ccode\u003edetails.error\u003c/code\u003e.\u003c/li\u003e\n\u003c/ol\u003e\n\u003cp\u003eFor the second path, send a \u003ccode\u003efields\u003c/code\u003e list to a generic action that returns a primitive and read the inspected \u003ccode\u003eAsh.Info.Manifest.Type\u003c/code\u003e struct in \u003ccode\u003evars.returnType\u003c/code\u003e of the resulting error.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "1. Expose an AshTypescript RPC action that takes a struct-typed argument, for example an `assignee` argument whose struct has a UUID `id` field.\n2. Send the action request with an invalid nested value, such as `{\"assignee\": {\"id\": \"not-a-uuid\", \"name\": \"x\", \"email\": \"e\"}}`.\n3. Read the response: each pair of the raw `Ash.Type` cast error is returned as its own `field_validation_error` with the inspected term in `details.error`.\n\nFor the second path, send a `fields` list to a generic action that returns a primitive and read the inspected `Ash.Info.Manifest.Type` struct in `vars.returnType` of the resulting error."
}
],
"value": "* Expose an AshTypescript RPC action that takes a struct-typed argument, for example an assignee argument whose struct has a UUID id field.\n* Send the action request with an invalid nested value, such as {\"assignee\": {\"id\": \"not-a-uuid\", \"name\": \"x\", \"email\": \"e\"}}.\n* Read the response: each pair of the raw Ash.Type cast error is returned as its own field_validation_error with the inspected term in details.error.\n\nFor the second path, send a fields list to a generic action that returns a primitive and read the inspected Ash.Info.Manifest.Type struct in vars.returnType of the resulting error."
}
],
"x_technicalAnalysis": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cstrong\u003e1. Error funnel.\u003c/strong\u003e \u003ccode\u003eAshTypescript.Rpc.run_action/3\u003c/code\u003e runs the request through \u003ccode\u003ePipeline.parse_request/3\u003c/code\u003e, \u003ccode\u003eexecute_ash_action/1\u003c/code\u003e and \u003ccode\u003eprocess_result/2\u003c/code\u003e. Any \u003ccode\u003e{:error, reason}\u003c/code\u003e from these goes to \u003ccode\u003eerror_response/1\u003c/code\u003e, which calls \u003ccode\u003eAshTypescript.Rpc.ErrorBuilder.build_error_response/1\u003c/code\u003e with the raw reason term.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e2. Unredacted fallbacks.\u003c/strong\u003e \u003ccode\u003ebuild_error_response/1\u003c/code\u003e has clauses for the error tuples the pipeline is expected to emit. A two-tuple whose first element is an atom but matches no clause is rendered as \u003ccode\u003efield_validation_error\u003c/code\u003e with \u003ccode\u003edetails.error\u003c/code\u003e set to \u003ccode\u003einspect(error)\u003c/code\u003e, and any other term becomes \u003ccode\u003eunknown_error\u003c/code\u003e with \u003ccode\u003edetails.error\u003c/code\u003e set to \u003ccode\u003einspect(other)\u003c/code\u003e. Ash exceptions never reach these clauses because \u003ccode\u003eAshTypescript.Rpc.Errors\u003c/code\u003e handles them and redacts unhandled ones behind an \u003ccode\u003eerrorId\u003c/code\u003e, so only this path has no redaction.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e3. Reachable triggers.\u003c/strong\u003e \u003ccode\u003eAshTypescript.Rpc.InputFormatter.cast_map_to_struct/2\u003c/code\u003e throws the raw \u003ccode\u003eAsh.Type.cast_input/3\u003c/code\u003e error, a keyword list, when a struct-typed argument fails to cast, and \u003ccode\u003eformat/6\u003c/code\u003e turns the throw into \u003ccode\u003e{:error, term}\u003c/code\u003e for the funnel. Separately, requesting \u003ccode\u003efields\u003c/code\u003e on a generic action whose return type is a primitive produces an \u003ccode\u003e{:invalid_field_selection, :primitive_type, return_type, ...}\u003c/code\u003e tuple whose \u003ccode\u003ereturn_type\u003c/code\u003e is formatted by \u003ccode\u003eformat_field_type/1\u003c/code\u003e, which inspects the whole \u003ccode\u003eAsh.Info.Manifest.Type\u003c/code\u003e struct, constraints and decoration included, into \u003ccode\u003evars.returnType\u003c/code\u003e.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "**1. Error funnel.** `AshTypescript.Rpc.run_action/3` runs the request through `Pipeline.parse_request/3`, `execute_ash_action/1` and `process_result/2`. Any `{:error, reason}` from these goes to `error_response/1`, which calls `AshTypescript.Rpc.ErrorBuilder.build_error_response/1` with the raw reason term.\n\n**2. Unredacted fallbacks.** `build_error_response/1` has clauses for the error tuples the pipeline is expected to emit. A two-tuple whose first element is an atom but matches no clause is rendered as `field_validation_error` with `details.error` set to `inspect(error)`, and any other term becomes `unknown_error` with `details.error` set to `inspect(other)`. Ash exceptions never reach these clauses because `AshTypescript.Rpc.Errors` handles them and redacts unhandled ones behind an `errorId`, so only this path has no redaction.\n\n**3. Reachable triggers.** `AshTypescript.Rpc.InputFormatter.cast_map_to_struct/2` throws the raw `Ash.Type.cast_input/3` error, a keyword list, when a struct-typed argument fails to cast, and `format/6` turns the throw into `{:error, term}` for the funnel. Separately, requesting `fields` on a generic action whose return type is a primitive produces an `{:invalid_field_selection, :primitive_type, return_type, ...}` tuple whose `return_type` is formatted by `format_field_type/1`, which inspects the whole `Ash.Info.Manifest.Type` struct, constraints and decoration included, into `vars.returnType`."
}
],
"value": "1. Error funnel. AshTypescript.Rpc.run_action/3 runs the request through Pipeline.parse_request/3, execute_ash_action/1 and process_result/2. Any {:error, reason} from these goes to error_response/1, which calls AshTypescript.Rpc.ErrorBuilder.build_error_response/1 with the raw reason term.\n\n2. Unredacted fallbacks. build_error_response/1 has clauses for the error tuples the pipeline is expected to emit. A two-tuple whose first element is an atom but matches no clause is rendered as field_validation_error with details.error set to inspect(error), and any other term becomes unknown_error with details.error set to inspect(other). Ash exceptions never reach these clauses because AshTypescript.Rpc.Errors handles them and redacts unhandled ones behind an errorId, so only this path has no redaction.\n\n3. Reachable triggers. AshTypescript.Rpc.InputFormatter.cast_map_to_struct/2 throws the raw Ash.Type.cast_input/3 error, a keyword list, when a struct-typed argument fails to cast, and format/6 turns the throw into {:error, term} for the funnel. Separately, requesting fields on a generic action whose return type is a primitive produces an {:invalid_field_selection, :primitive_type, return_type, ...} tuple whose return_type is formatted by format_field_type/1, which inspects the whole Ash.Info.Manifest.Type struct, constraints and decoration included, into vars.returnType."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-105283",
"datePublished": "2026-10-12T11:16:30.582Z",
"dateReserved": "2026-10-10T13:15:02.310Z",
"dateUpdated": "2026-10-16T16:53:18.072Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-101028 (GCVE-0-2026-101028)
Vulnerability from nvd – Published: 2026-10-09 07:01 – Updated: 2026-10-09 18:04
VLAI
EPSS
VEX
Title
Ash.count, Ash.exists and Ash.aggregate skip related resources' read policies in filters and sorts
Summary
Incorrect Authorization vulnerability in ash-project ash allows an actor to infer data in related records they cannot read via Ash.count/2, Ash.exists/2 and Ash.aggregate/3.
Ash.Actions.Aggregate.run/4 (lib/ash/actions/aggregate.ex) applied only the root resource's read policy before running the aggregate query. The read path also applies each related resource's read policy to filter and sort references that cross a relationship, directly (for example comments.body) or through an aggregate over one, but the aggregate path skipped that step. A caller whose filter or sort reaches these functions, for example through Ash.Query.filter_input/2, an ash_lua script, or an AshAi tool offering count or exists results, can test conditions against related rows hidden from them and recover their existence and attribute values one query at a time. Ash.read/2 and its page counts are not affected.
This issue affects ash: from 2.6.0 before 3.34.6.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-09 18:03 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash/security/advis… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-101028.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-101028 | related |
| https://github.com/ash-project/ash/commit/30eaf1c… | related |
| https://github.com/ash-project/ash/commit/8093618… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash |
Affected:
2.6.0 , < 3.34.6
(semver)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
|
| ash-project | ash |
Affected:
30eaf1c6e8524527b703e3c4bfeff7967ee0b37c , < 80936187b27ee94f15cd875affd3141b5cb23185
(git)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-101028",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-09T18:03:54.666261Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T18:04:24.729Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-xj24-8f5c-pp5p"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Actions.Aggregate\u0027",
"\u0027Elixir.Ash\u0027"
],
"packageName": "ash",
"packageURL": "pkg:hex/ash",
"product": "ash",
"programFiles": [
"lib/ash/actions/aggregate.ex",
"lib/ash.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Actions.Aggregate\u0027:run/4"
},
{
"name": "\u0027Elixir.Ash\u0027:count/2"
},
{
"name": "\u0027Elixir.Ash\u0027:exists/2"
},
{
"name": "\u0027Elixir.Ash\u0027:aggregate/3"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "3.34.6",
"status": "affected",
"version": "2.6.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Actions.Aggregate\u0027",
"\u0027Elixir.Ash\u0027"
],
"packageName": "ash-project/ash",
"packageURL": "pkg:github/ash-project/ash",
"product": "ash",
"programFiles": [
"lib/ash/actions/aggregate.ex",
"lib/ash.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Actions.Aggregate\u0027:run/4"
},
{
"name": "\u0027Elixir.Ash\u0027:count/2"
},
{
"name": "\u0027Elixir.Ash\u0027:exists/2"
},
{
"name": "\u0027Elixir.Ash\u0027:aggregate/3"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "80936187b27ee94f15cd875affd3141b5cb23185",
"status": "affected",
"version": "30eaf1c6e8524527b703e3c4bfeff7967ee0b37c",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eReachable only when an application passes caller-supplied filters or sorts that cross a relationship into \u003ccode\u003eAsh.count/2\u003c/code\u003e, \u003ccode\u003eAsh.exists/2\u003c/code\u003e or \u003ccode\u003eAsh.aggregate/3\u003c/code\u003e (directly, through ash_lua read operations, or through AshAi count, exists or aggregate result types), and a related resource\u0027s read policy is stricter than the root resource\u0027s.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Reachable only when an application passes caller-supplied filters or sorts that cross a relationship into `Ash.count/2`, `Ash.exists/2` or `Ash.aggregate/3` (directly, through ash_lua read operations, or through AshAi count, exists or aggregate result types), and a related resource\u0027s read policy is stricter than the root resource\u0027s."
}
],
"value": "Reachable only when an application passes caller-supplied filters or sorts that cross a relationship into Ash.count/2, Ash.exists/2 or Ash.aggregate/3 (directly, through ash_lua read operations, or through AshAi count, exists or aggregate result types), and a related resource\u0027s read policy is stricter than the root resource\u0027s."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.34.6",
"versionStartIncluding": "2.6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Glenn Rempe"
},
{
"lang": "en",
"type": "finder",
"value": "Glenn Rempe"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
}
],
"dateAssigned": "2026-10-09T00:19:31.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIncorrect Authorization vulnerability in ash-project ash allows an actor to infer data in related records they cannot read via \u003ccode\u003eAsh.count/2\u003c/code\u003e, \u003ccode\u003eAsh.exists/2\u003c/code\u003e and \u003ccode\u003eAsh.aggregate/3\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eAsh.Actions.Aggregate.run/4\u003c/code\u003e (\u003ccode\u003elib/ash/actions/aggregate.ex\u003c/code\u003e) applied only the root resource\u0027s read policy before running the aggregate query. The read path also applies each related resource\u0027s read policy to filter and sort references that cross a relationship, directly (for example \u003ccode\u003ecomments.body\u003c/code\u003e) or through an aggregate over one, but the aggregate path skipped that step. A caller whose filter or sort reaches these functions, for example through \u003ccode\u003eAsh.Query.filter_input/2\u003c/code\u003e, an ash_lua script, or an AshAi tool offering count or exists results, can test conditions against related rows hidden from them and recover their existence and attribute values one query at a time. \u003ccode\u003eAsh.read/2\u003c/code\u003e and its page counts are not affected.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash: from 2.6.0 before 3.34.6.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Incorrect Authorization vulnerability in ash-project ash allows an actor to infer data in related records they cannot read via `Ash.count/2`, `Ash.exists/2` and `Ash.aggregate/3`.\n\n`Ash.Actions.Aggregate.run/4` (`lib/ash/actions/aggregate.ex`) applied only the root resource\u0027s read policy before running the aggregate query. The read path also applies each related resource\u0027s read policy to filter and sort references that cross a relationship, directly (for example `comments.body`) or through an aggregate over one, but the aggregate path skipped that step. A caller whose filter or sort reaches these functions, for example through `Ash.Query.filter_input/2`, an ash_lua script, or an AshAi tool offering count or exists results, can test conditions against related rows hidden from them and recover their existence and attribute values one query at a time. `Ash.read/2` and its page counts are not affected.\n\nThis issue affects ash: from 2.6.0 before 3.34.6."
}
],
"value": "Incorrect Authorization vulnerability in ash-project ash allows an actor to infer data in related records they cannot read via Ash.count/2, Ash.exists/2 and Ash.aggregate/3.\n\nAsh.Actions.Aggregate.run/4 (lib/ash/actions/aggregate.ex) applied only the root resource\u0027s read policy before running the aggregate query. The read path also applies each related resource\u0027s read policy to filter and sort references that cross a relationship, directly (for example comments.body) or through an aggregate over one, but the aggregate path skipped that step. A caller whose filter or sort reaches these functions, for example through Ash.Query.filter_input/2, an ash_lua script, or an AshAi tool offering count or exists results, can test conditions against related rows hidden from them and recover their existence and attribute values one query at a time. Ash.read/2 and its page counts are not affected.\n\nThis issue affects ash: from 2.6.0 before 3.34.6."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T07:01:06.470Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "GHSA-xj24-8f5c-pp5p",
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-xj24-8f5c-pp5p"
},
{
"name": "EEF CNA record for CVE-2026-101028",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-101028.html"
},
{
"name": "OSV record EEF-CVE-2026-101028",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-101028"
},
{
"name": "Introducing commit 30eaf1c in ash-project/ash",
"tags": [
"related"
],
"url": "https://github.com/ash-project/ash/commit/30eaf1c6e8524527b703e3c4bfeff7967ee0b37c"
},
{
"name": "Fix commit 8093618 in ash-project/ash",
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash/commit/80936187b27ee94f15cd875affd3141b5cb23185"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Ash.count, Ash.exists and Ash.aggregate skip related resources\u0027 read policies in filters and sorts"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-101028",
"datePublished": "2026-10-09T07:01:06.470Z",
"dateReserved": "2026-10-08T15:45:02.376Z",
"dateUpdated": "2026-10-09T18:04:24.729Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-94201 (GCVE-0-2026-94201)
Vulnerability from nvd – Published: 2026-10-05 19:19 – Updated: 2026-10-06 13:41
VLAI
EPSS
VEX
Title
Filtering an :atom attribute with unsafe_to_atom? can exhaust the BEAM atom table in Ash
Summary
Ash stores :atom-typed attributes as strings and compares them as strings. When such an attribute is referenced in a filter, the comparison value is coerced through Ash.Type.Atom. Because the type defined no coerce/2 callback, coercion fell back to the default (cast_input/2), which calls String.to_atom/1 when the attribute is configured with the unsafe_to_atom?: true constraint.
Filtering such an attribute with attacker-controlled strings therefore interned a new, permanent atom for every distinct value. Atoms are never garbage collected and the BEAM caps the atom table, so an actor who can supply filter values for a public, filterable :atom attribute declared with unsafe_to_atom?: true can exhaust the atom table and crash the node (denial of service). AshPaperTrail is a notable example: its version resources expose a public, filterable version_action_name atom attribute with unsafe_to_atom?: true by default.
The fix adds a coerce/2 to Ash.Type.Atom that never interns atoms — a comparison value is left as a string, since the type is stored and compared as a string. Setting the attribute from action input (cast_input/2, which still honors unsafe_to_atom?) is unchanged.
This issue affects ash: from 3.5.1 before 3.34.3.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 13:41 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://cna.erlef.org/cves/CVE-2026-94201.html | relatedthird-party-advisory |
| https://osv.dev/vulnerability/EEF-CVE-2026-94201 | related |
| https://github.com/ash-project/ash/commit/2970ba3… | related |
| https://github.com/ash-project/ash/commit/5282f3f… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash |
Affected:
3.5.1 , < 3.34.3
(semver)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
|
| ash-project | ash |
Affected:
2970ba3bd5d36d6ad04c731ac87385375d457147 , < 5282f3f513053628cdd1bf2236ea22d975d934d4
(git)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-94201",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T13:41:07.117450Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T13:41:22.142Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Type.Atom\u0027"
],
"packageName": "ash",
"packageURL": "pkg:hex/ash",
"product": "ash",
"programFiles": [
"lib/ash/type/atom.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Type.Atom\u0027:cast_value/2"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "3.34.3",
"status": "affected",
"version": "3.5.1",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Type.Atom\u0027"
],
"packageName": "ash-project/ash",
"packageURL": "pkg:github/ash-project/ash",
"product": "ash",
"programFiles": [
"lib/ash/type/atom.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Type.Atom\u0027:cast_value/2"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "5282f3f513053628cdd1bf2236ea22d975d934d4",
"status": "affected",
"version": "2970ba3bd5d36d6ad04c731ac87385375d457147",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eReachable only when an application exposes a public, filterable \u003ccode\u003e:atom\u003c/code\u003e attribute declared with the \u003ccode\u003eunsafe_to_atom?: true\u003c/code\u003e constraint, and an actor can supply filter values for it (for example through AshGraphql, AshJsonApi, or \u003ccode\u003eAsh.Query.filter_input/2\u003c/code\u003e). AshPaperTrail\u0027s version resources ship such an attribute (\u003ccode\u003eversion_action_name\u003c/code\u003e) by default.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Reachable only when an application exposes a public, filterable `:atom` attribute declared with the `unsafe_to_atom?: true` constraint, and an actor can supply filter values for it (for example through AshGraphql, AshJsonApi, or `Ash.Query.filter_input/2`). AshPaperTrail\u0027s version resources ship such an attribute (`version_action_name`) by default."
}
],
"value": "Reachable only when an application exposes a public, filterable :atom attribute declared with the unsafe_to_atom?: true constraint, and an actor can supply filter values for it (for example through AshGraphql, AshJsonApi, or Ash.Query.filter_input/2). AshPaperTrail\u0027s version resources ship such an attribute (version_action_name) by default."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.34.3",
"versionStartIncluding": "3.5.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Quinn Wilton"
},
{
"lang": "en",
"type": "reporter",
"value": "Quinn Wilton"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"dateAssigned": "2026-10-04T15:49:18.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAsh stores \u003ccode\u003e:atom\u003c/code\u003e-typed attributes as strings and compares them as strings. When such an attribute is referenced in a filter, the comparison value is coerced through \u003ccode\u003eAsh.Type.Atom\u003c/code\u003e. Because the type defined no \u003ccode\u003ecoerce/2\u003c/code\u003e callback, coercion fell back to the default (\u003ccode\u003ecast_input/2\u003c/code\u003e), which calls \u003ccode\u003eString.to_atom/1\u003c/code\u003e when the attribute is configured with the \u003ccode\u003eunsafe_to_atom?: true\u003c/code\u003e constraint.\u003c/p\u003e\n\u003cp\u003eFiltering such an attribute with attacker-controlled strings therefore interned a new, permanent atom for every distinct value. Atoms are never garbage collected and the BEAM caps the atom table, so an actor who can supply filter values for a public, filterable \u003ccode\u003e:atom\u003c/code\u003e attribute declared with \u003ccode\u003eunsafe_to_atom?: true\u003c/code\u003e can exhaust the atom table and crash the node (denial of service). AshPaperTrail is a notable example: its version resources expose a public, filterable \u003ccode\u003eversion_action_name\u003c/code\u003e atom attribute with \u003ccode\u003eunsafe_to_atom?: true\u003c/code\u003e by default.\u003c/p\u003e\n\u003cp\u003eThe fix adds a \u003ccode\u003ecoerce/2\u003c/code\u003e to \u003ccode\u003eAsh.Type.Atom\u003c/code\u003e that never interns atoms \u2014 a comparison value is left as a string, since the type is stored and compared as a string. Setting the attribute from action input (\u003ccode\u003ecast_input/2\u003c/code\u003e, which still honors \u003ccode\u003eunsafe_to_atom?\u003c/code\u003e) is unchanged.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash: from 3.5.1 before 3.34.3.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Ash stores `:atom`-typed attributes as strings and compares them as strings. When such an attribute is referenced in a filter, the comparison value is coerced through `Ash.Type.Atom`. Because the type defined no `coerce/2` callback, coercion fell back to the default (`cast_input/2`), which calls `String.to_atom/1` when the attribute is configured with the `unsafe_to_atom?: true` constraint.\n\nFiltering such an attribute with attacker-controlled strings therefore interned a new, permanent atom for every distinct value. Atoms are never garbage collected and the BEAM caps the atom table, so an actor who can supply filter values for a public, filterable `:atom` attribute declared with `unsafe_to_atom?: true` can exhaust the atom table and crash the node (denial of service). AshPaperTrail is a notable example: its version resources expose a public, filterable `version_action_name` atom attribute with `unsafe_to_atom?: true` by default.\n\nThe fix adds a `coerce/2` to `Ash.Type.Atom` that never interns atoms \u2014 a comparison value is left as a string, since the type is stored and compared as a string. Setting the attribute from action input (`cast_input/2`, which still honors `unsafe_to_atom?`) is unchanged.\n\nThis issue affects ash: from 3.5.1 before 3.34.3."
}
],
"value": "Ash stores :atom-typed attributes as strings and compares them as strings. When such an attribute is referenced in a filter, the comparison value is coerced through Ash.Type.Atom. Because the type defined no coerce/2 callback, coercion fell back to the default (cast_input/2), which calls String.to_atom/1 when the attribute is configured with the unsafe_to_atom?: true constraint.\n\nFiltering such an attribute with attacker-controlled strings therefore interned a new, permanent atom for every distinct value. Atoms are never garbage collected and the BEAM caps the atom table, so an actor who can supply filter values for a public, filterable :atom attribute declared with unsafe_to_atom?: true can exhaust the atom table and crash the node (denial of service). AshPaperTrail is a notable example: its version resources expose a public, filterable version_action_name atom attribute with unsafe_to_atom?: true by default.\n\nThe fix adds a coerce/2 to Ash.Type.Atom that never interns atoms \u2014 a comparison value is left as a string, since the type is stored and compared as a string. Setting the attribute from action input (cast_input/2, which still honors unsafe_to_atom?) is unchanged.\n\nThis issue affects ash: from 3.5.1 before 3.34.3."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-130 Excessive Allocation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T19:19:51.326Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "EEF CNA record for CVE-2026-94201",
"tags": [
"related",
"third-party-advisory"
],
"url": "https://cna.erlef.org/cves/CVE-2026-94201.html"
},
{
"name": "OSV record EEF-CVE-2026-94201",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-94201"
},
{
"name": "Introducing commit 2970ba3 in ash-project/ash",
"tags": [
"related"
],
"url": "https://github.com/ash-project/ash/commit/2970ba3bd5d36d6ad04c731ac87385375d457147"
},
{
"name": "Fix commit 5282f3f in ash-project/ash",
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash/commit/5282f3f513053628cdd1bf2236ea22d975d934d4"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Filtering an :atom attribute with unsafe_to_atom? can exhaust the BEAM atom table in Ash"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-94201",
"datePublished": "2026-10-05T19:19:51.326Z",
"dateReserved": "2026-09-24T09:15:02.216Z",
"dateUpdated": "2026-10-06T13:41:22.142Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93477 (GCVE-0-2026-93477)
Vulnerability from nvd – Published: 2026-09-25 07:08 – Updated: 2026-09-25 13:26
VLAI
EPSS
VEX
Title
Private action arguments can be set by user input on the bulk destroy and bulk update paths in Ash
Summary
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash allows a user to set the value of a private action argument on the bulk destroy and bulk update paths.
Action arguments declared with public?: false are meant to be set only by trusted server-side code (for example via Ash.Changeset.set_private_argument/3) and must not be settable from end-user input. CVE-2026-55736 fixed the non-bulk changeset path to strip private arguments from user-supplied parameter maps, but the bulk destroy and bulk update paths were not covered.
Ash.Actions.Destroy.Bulk.base_changeset/5 and Ash.Actions.Update.Bulk.base_changeset/5 match every key in the caller-supplied parameter map against all of the action's arguments with no public? check, then apply the matches to the base changeset. A caller who can submit parameters to a bulk destroy or bulk update action (for example through AshJsonApi, AshGraphql, or a controller that forwards request parameters to Ash.bulk_destroy/4 or Ash.bulk_update/4) can therefore set any private argument of that action, including one referenced by an arg(...) template in the action's changes or validations. Depending on how the application uses the argument (for example an acting_user_id driving authorization or record ownership, or audit metadata), this can lead to an integrity violation or privilege escalation.
The fix requires public? in the argument matching on both bulk paths; private arguments remain settable server-side via the :private_arguments option.
This issue affects ash: from 2.17.15 before 3.33.11.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-25 13:26 UTC
CWE
- CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes
Assigner
References
5 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash |
Affected:
2.17.15 , < 3.33.11
(semver)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
|
| ash-project | ash |
Affected:
8c17434803b2e91de522bdfbd0ca918e5d5898df , < 6b7ac53a0a2532291eb940d7beaf0fbb2da6fc4f
(git)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-93477",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-25T13:26:14.200048Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T13:26:42.369Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-c2p4-p7q6-hr2j"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Actions.Destroy.Bulk\u0027",
"\u0027Elixir.Ash.Actions.Update.Bulk\u0027"
],
"packageName": "ash",
"packageURL": "pkg:hex/ash",
"product": "ash",
"programFiles": [
"lib/ash/actions/destroy/bulk.ex",
"lib/ash/actions/update/bulk.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Actions.Destroy.Bulk\u0027:base_changeset/5"
},
{
"name": "\u0027Elixir.Ash.Actions.Update.Bulk\u0027:base_changeset/5"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "3.33.11",
"status": "affected",
"version": "2.17.15",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Actions.Destroy.Bulk\u0027",
"\u0027Elixir.Ash.Actions.Update.Bulk\u0027"
],
"packageName": "ash-project/ash",
"packageURL": "pkg:github/ash-project/ash",
"product": "ash",
"programFiles": [
"lib/ash/actions/destroy/bulk.ex",
"lib/ash/actions/update/bulk.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Actions.Destroy.Bulk\u0027:base_changeset/5"
},
{
"name": "\u0027Elixir.Ash.Actions.Update.Bulk\u0027:base_changeset/5"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "6b7ac53a0a2532291eb940d7beaf0fbb2da6fc4f",
"status": "affected",
"version": "8c17434803b2e91de522bdfbd0ca918e5d5898df",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn action must declare a private argument (\u003ccode\u003epublic?: false\u003c/code\u003e) that is referenced by an \u003ccode\u003earg(...)\u003c/code\u003e template in one of its changes or validations, be invocable as a bulk destroy or bulk update, and the application must pass untrusted user-supplied parameters into \u003ccode\u003eAsh.bulk_destroy/4\u003c/code\u003e or \u003ccode\u003eAsh.bulk_update/4\u003c/code\u003e (directly or through AshJsonApi/AshGraphql).\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "An action must declare a private argument (`public?: false`) that is referenced by an `arg(...)` template in one of its changes or validations, be invocable as a bulk destroy or bulk update, and the application must pass untrusted user-supplied parameters into `Ash.bulk_destroy/4` or `Ash.bulk_update/4` (directly or through AshJsonApi/AshGraphql)."
}
],
"value": "An action must declare a private argument (public?: false) that is referenced by an arg(...) template in one of its changes or validations, be invocable as a bulk destroy or bulk update, and the application must pass untrusted user-supplied parameters into Ash.bulk_destroy/4 or Ash.bulk_update/4 (directly or through AshJsonApi/AshGraphql)."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.33.11",
"versionStartIncluding": "2.17.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "zx"
},
{
"lang": "en",
"type": "reporter",
"value": "zx"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"dateAssigned": "2026-09-25T06:50:10.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash allows a user to set the value of a private action argument on the bulk destroy and bulk update paths.\u003c/p\u003e\n\u003cp\u003eAction arguments declared with \u003ccode\u003epublic?: false\u003c/code\u003e are meant to be set only by trusted server-side code (for example via \u003ccode\u003eAsh.Changeset.set_private_argument/3\u003c/code\u003e) and must not be settable from end-user input. CVE-2026-55736 fixed the non-bulk changeset path to strip private arguments from user-supplied parameter maps, but the bulk destroy and bulk update paths were not covered.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eAsh.Actions.Destroy.Bulk.base_changeset/5\u003c/code\u003e and \u003ccode\u003eAsh.Actions.Update.Bulk.base_changeset/5\u003c/code\u003e match every key in the caller-supplied parameter map against all of the action\u0027s arguments with no \u003ccode\u003epublic?\u003c/code\u003e check, then apply the matches to the base changeset. A caller who can submit parameters to a bulk destroy or bulk update action (for example through AshJsonApi, AshGraphql, or a controller that forwards request parameters to \u003ccode\u003eAsh.bulk_destroy/4\u003c/code\u003e or \u003ccode\u003eAsh.bulk_update/4\u003c/code\u003e) can therefore set any private argument of that action, including one referenced by an \u003ccode\u003earg(...)\u003c/code\u003e template in the action\u0027s changes or validations. Depending on how the application uses the argument (for example an \u003ccode\u003eacting_user_id\u003c/code\u003e driving authorization or record ownership, or audit metadata), this can lead to an integrity violation or privilege escalation.\u003c/p\u003e\n\u003cp\u003eThe fix requires \u003ccode\u003epublic?\u003c/code\u003e in the argument matching on both bulk paths; private arguments remain settable server-side via the \u003ccode\u003e:private_arguments\u003c/code\u003e option.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash: from 2.17.15 before 3.33.11.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash allows a user to set the value of a private action argument on the bulk destroy and bulk update paths.\n\nAction arguments declared with `public?: false` are meant to be set only by trusted server-side code (for example via `Ash.Changeset.set_private_argument/3`) and must not be settable from end-user input. CVE-2026-55736 fixed the non-bulk changeset path to strip private arguments from user-supplied parameter maps, but the bulk destroy and bulk update paths were not covered.\n\n`Ash.Actions.Destroy.Bulk.base_changeset/5` and `Ash.Actions.Update.Bulk.base_changeset/5` match every key in the caller-supplied parameter map against all of the action\u0027s arguments with no `public?` check, then apply the matches to the base changeset. A caller who can submit parameters to a bulk destroy or bulk update action (for example through AshJsonApi, AshGraphql, or a controller that forwards request parameters to `Ash.bulk_destroy/4` or `Ash.bulk_update/4`) can therefore set any private argument of that action, including one referenced by an `arg(...)` template in the action\u0027s changes or validations. Depending on how the application uses the argument (for example an `acting_user_id` driving authorization or record ownership, or audit metadata), this can lead to an integrity violation or privilege escalation.\n\nThe fix requires `public?` in the argument matching on both bulk paths; private arguments remain settable server-side via the `:private_arguments` option.\n\nThis issue affects ash: from 2.17.15 before 3.33.11."
}
],
"value": "Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash allows a user to set the value of a private action argument on the bulk destroy and bulk update paths.\n\nAction arguments declared with public?: false are meant to be set only by trusted server-side code (for example via Ash.Changeset.set_private_argument/3) and must not be settable from end-user input. CVE-2026-55736 fixed the non-bulk changeset path to strip private arguments from user-supplied parameter maps, but the bulk destroy and bulk update paths were not covered.\n\nAsh.Actions.Destroy.Bulk.base_changeset/5 and Ash.Actions.Update.Bulk.base_changeset/5 match every key in the caller-supplied parameter map against all of the action\u0027s arguments with no public? check, then apply the matches to the base changeset. A caller who can submit parameters to a bulk destroy or bulk update action (for example through AshJsonApi, AshGraphql, or a controller that forwards request parameters to Ash.bulk_destroy/4 or Ash.bulk_update/4) can therefore set any private argument of that action, including one referenced by an arg(...) template in the action\u0027s changes or validations. Depending on how the application uses the argument (for example an acting_user_id driving authorization or record ownership, or audit metadata), this can lead to an integrity violation or privilege escalation.\n\nThe fix requires public? in the argument matching on both bulk paths; private arguments remain settable server-side via the :private_arguments option.\n\nThis issue affects ash: from 2.17.15 before 3.33.11."
}
],
"impacts": [
{
"capecId": "CAPEC-77",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-77 Manipulating User-Controlled Variables"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-915",
"description": "CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T07:08:55.191Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "GHSA-c2p4-p7q6-hr2j",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-c2p4-p7q6-hr2j"
},
{
"name": "EEF CNA record for CVE-2026-93477",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-93477.html"
},
{
"name": "OSV record EEF-CVE-2026-93477",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-93477"
},
{
"name": "Introducing commit 8c17434 in ash-project/ash",
"tags": [
"related"
],
"url": "https://github.com/ash-project/ash/commit/8c17434803b2e91de522bdfbd0ca918e5d5898df"
},
{
"name": "Fix commit 6b7ac53 in ash-project/ash",
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash/commit/6b7ac53a0a2532291eb940d7beaf0fbb2da6fc4f"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Private action arguments can be set by user input on the bulk destroy and bulk update paths in Ash"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-93477",
"datePublished": "2026-09-25T07:08:55.191Z",
"dateReserved": "2026-09-19T16:00:02.004Z",
"dateUpdated": "2026-09-25T13:26:42.369Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86338 (GCVE-0-2026-86338)
Vulnerability from nvd – Published: 2026-09-16 08:28 – Updated: 2026-09-16 14:49
VLAI
EPSS
VEX
Title
Ash field policies do not filter-nil forbidden calculations and aggregates, enabling an information-disclosure oracle
Summary
Ash field_policies are documented to protect against filter-based information disclosure: when a field the actor may not see is referenced in a filter, it is replaced with an expression that evaluates to nil, so a filter cannot be used as a yes/no oracle to read a value the actor cannot see.
This nilling was applied to attributes but not to calculations or aggregates. A user-supplied filter reference to a calculation or aggregate carries an Ash.Query.Calculation / Ash.Query.Aggregate struct, which the authorizer's reference replacement did not match (it only matched the Ash.Resource.* structs), so the filter ran against the real value.
As a result, an actor whose field policies forbid a calculation or aggregate can still filter by it (for example filter(secret_calc == "x") or filter(comment_count == n)) and learn the value from whether rows match — an oracle that recovers field-policy-protected values one probe at a time. Filtering is commonly exposed to lower-privileged actors (for example via AshGraphql or AshJsonApi filter arguments), which is exactly the surface field policies are meant to protect.
The fix routes filter references to calculations and aggregates through the same field-policy nilling as attributes.
This issue affects ash: from 2.11.0-rc.0 before 3.33.4.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 14:49 UTC
CWE
- CWE-1220 - Insufficient Granularity of Access Control
Assigner
References
5 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash |
Affected:
2.11.0-rc.0 , < 3.33.4
(semver)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
|
| ash-project | ash |
Affected:
0b6d93c7c4637280b46ae66ea1d2eaf013701238 , < b3d4503241f3deacb5ceb955e10a4fa927da0f67
(git)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86338",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T14:49:09.195379Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T14:49:17.203Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Policy.Authorizer\u0027"
],
"packageName": "ash",
"packageURL": "pkg:hex/ash",
"product": "ash",
"programFiles": [
"lib/ash/policy/authorizer/authorizer.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Policy.Authorizer\u0027:do_replace_ref/2"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "3.33.4",
"status": "affected",
"version": "2.11.0-rc.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Policy.Authorizer\u0027"
],
"packageName": "ash-project/ash",
"packageURL": "pkg:github/ash-project/ash",
"product": "ash",
"programFiles": [
"lib/ash/policy/authorizer/authorizer.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Policy.Authorizer\u0027:do_replace_ref/2"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "b3d4503241f3deacb5ceb955e10a4fa927da0f67",
"status": "affected",
"version": "0b6d93c7c4637280b46ae66ea1d2eaf013701238",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eReachable only when an application uses \u003ccode\u003eAsh.Policy.Authorizer\u003c/code\u003e field policies to restrict a calculation or aggregate, and exposes filtering on it to an actor who is denied that field (for example an authenticated user filtering through AshGraphql or AshJsonApi).\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Reachable only when an application uses `Ash.Policy.Authorizer` field policies to restrict a calculation or aggregate, and exposes filtering on it to an actor who is denied that field (for example an authenticated user filtering through AshGraphql or AshJsonApi)."
}
],
"value": "Reachable only when an application uses Ash.Policy.Authorizer field policies to restrict a calculation or aggregate, and exposes filtering on it to an actor who is denied that field (for example an authenticated user filtering through AshGraphql or AshJsonApi)."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.33.4",
"versionStartIncluding": "2.11.0-rc.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Jesse Williams"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "finder",
"value": "Jesse Williams"
}
],
"dateAssigned": "2026-09-15T23:33:34.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAsh \u003ccode\u003efield_policies\u003c/code\u003e are documented to protect against filter-based information disclosure: when a field the actor may not see is referenced in a filter, it is replaced with an expression that evaluates to \u003ccode\u003enil\u003c/code\u003e, so a filter cannot be used as a yes/no oracle to read a value the actor cannot see.\u003c/p\u003e\n\u003cp\u003eThis nilling was applied to attributes but not to calculations or aggregates. A user-supplied filter reference to a calculation or aggregate carries an \u003ccode\u003eAsh.Query.Calculation\u003c/code\u003e / \u003ccode\u003eAsh.Query.Aggregate\u003c/code\u003e struct, which the authorizer\u0027s reference replacement did not match (it only matched the \u003ccode\u003eAsh.Resource.*\u003c/code\u003e structs), so the filter ran against the real value.\u003c/p\u003e\n\u003cp\u003eAs a result, an actor whose field policies forbid a calculation or aggregate can still filter by it (for example \u003ccode\u003efilter(secret_calc == \"x\")\u003c/code\u003e or \u003ccode\u003efilter(comment_count == n)\u003c/code\u003e) and learn the value from whether rows match \u2014 an oracle that recovers field-policy-protected values one probe at a time. Filtering is commonly exposed to lower-privileged actors (for example via AshGraphql or AshJsonApi filter arguments), which is exactly the surface field policies are meant to protect.\u003c/p\u003e\n\u003cp\u003eThe fix routes filter references to calculations and aggregates through the same field-policy nilling as attributes.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash: from 2.11.0-rc.0 before 3.33.4.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Ash `field_policies` are documented to protect against filter-based information disclosure: when a field the actor may not see is referenced in a filter, it is replaced with an expression that evaluates to `nil`, so a filter cannot be used as a yes/no oracle to read a value the actor cannot see.\n\nThis nilling was applied to attributes but not to calculations or aggregates. A user-supplied filter reference to a calculation or aggregate carries an `Ash.Query.Calculation` / `Ash.Query.Aggregate` struct, which the authorizer\u0027s reference replacement did not match (it only matched the `Ash.Resource.*` structs), so the filter ran against the real value.\n\nAs a result, an actor whose field policies forbid a calculation or aggregate can still filter by it (for example `filter(secret_calc == \"x\")` or `filter(comment_count == n)`) and learn the value from whether rows match \u2014 an oracle that recovers field-policy-protected values one probe at a time. Filtering is commonly exposed to lower-privileged actors (for example via AshGraphql or AshJsonApi filter arguments), which is exactly the surface field policies are meant to protect.\n\nThe fix routes filter references to calculations and aggregates through the same field-policy nilling as attributes.\n\nThis issue affects ash: from 2.11.0-rc.0 before 3.33.4."
}
],
"value": "Ash field_policies are documented to protect against filter-based information disclosure: when a field the actor may not see is referenced in a filter, it is replaced with an expression that evaluates to nil, so a filter cannot be used as a yes/no oracle to read a value the actor cannot see.\n\nThis nilling was applied to attributes but not to calculations or aggregates. A user-supplied filter reference to a calculation or aggregate carries an Ash.Query.Calculation / Ash.Query.Aggregate struct, which the authorizer\u0027s reference replacement did not match (it only matched the Ash.Resource.* structs), so the filter ran against the real value.\n\nAs a result, an actor whose field policies forbid a calculation or aggregate can still filter by it (for example filter(secret_calc == \"x\") or filter(comment_count == n)) and learn the value from whether rows match \u2014 an oracle that recovers field-policy-protected values one probe at a time. Filtering is commonly exposed to lower-privileged actors (for example via AshGraphql or AshJsonApi filter arguments), which is exactly the surface field policies are meant to protect.\n\nThe fix routes filter references to calculations and aggregates through the same field-policy nilling as attributes.\n\nThis issue affects ash: from 2.11.0-rc.0 before 3.33.4."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1220",
"description": "CWE-1220 Insufficient Granularity of Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T08:28:44.114Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "GHSA-7qr8-wrvq-566q",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-7qr8-wrvq-566q"
},
{
"name": "EEF CNA record for CVE-2026-86338",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-86338.html"
},
{
"name": "OSV record EEF-CVE-2026-86338",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-86338"
},
{
"name": "Introducing commit 0b6d93c in ash-project/ash",
"tags": [
"related"
],
"url": "https://github.com/ash-project/ash/commit/0b6d93c7c4637280b46ae66ea1d2eaf013701238"
},
{
"name": "Fix commit b3d4503 in ash-project/ash",
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash/commit/b3d4503241f3deacb5ceb955e10a4fa927da0f67"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Ash field policies do not filter-nil forbidden calculations and aggregates, enabling an information-disclosure oracle"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-86338",
"datePublished": "2026-09-16T08:28:44.114Z",
"dateReserved": "2026-09-15T15:30:01.895Z",
"dateUpdated": "2026-09-16T14:49:17.203Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78230 (GCVE-0-2026-78230)
Vulnerability from nvd – Published: 2026-09-08 16:41 – Updated: 2026-09-08 17:33
VLAI
EPSS
VEX
Title
AshAi aggregate tool can read field-policy-protected fields
Summary
AshAi exposes Ash read actions to language-model tool calls. The read tool accepts an aggregate result type (min, max, sum, avg) that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value.
Ash field policies redact forbidden fields on returned records (replacing them with %Ash.ForbiddenField{}), but that redaction does not apply to aggregate values. A tool caller could therefore read a field the calling actor's field policies forbid by requesting it as an aggregate; min/max in particular return an actual field value. This includes fields that are public? true but restricted per-actor by a field policy, such as sensitive PII. The tool's existing check only required the field to be public, which is a separate axis from per-actor field-policy authorization.
The fix authorizes the aggregated field against the resource's field policies, so aggregating over a field the actor may not see is refused or scoped to the rows where it is visible.
This issue affects ash_ai: from 0.1.0 before 1.0.3.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 17:33 UTC
CWE
- CWE-1220 - Insufficient Granularity of Access Control
Assigner
References
5 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_ai |
Affected:
0.1.0 , < 1.0.3
(semver)
cpe:2.3:a:ash-project:ash_ai:*:*:*:*:*:*:*:* |
|
| ash-project | ash_ai |
Affected:
2ba234b50946a3b8116190c8467f9f4dfa5edce7 , < 9c02de581625c342c9870a672830bff28c1d701e
(git)
cpe:2.3:a:ash-project:ash_ai:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-78230",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T17:33:49.017554Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T17:33:57.604Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_ai:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAi.Tool.Execution\u0027"
],
"packageName": "ash_ai",
"packageURL": "pkg:hex/ash_ai",
"product": "ash_ai",
"programFiles": [
"lib/ash_ai/tool/execution.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAi.Tool.Execution\u0027:execute_read/4"
}
],
"repo": "https://github.com/ash-project/ash_ai",
"vendor": "ash-project",
"versions": [
{
"lessThan": "1.0.3",
"status": "affected",
"version": "0.1.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_ai:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAi.Tool.Execution\u0027"
],
"packageName": "ash-project/ash_ai",
"packageURL": "pkg:github/ash-project/ash_ai",
"product": "ash_ai",
"programFiles": [
"lib/ash_ai/tool/execution.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAi.Tool.Execution\u0027:execute_read/4"
}
],
"repo": "https://github.com/ash-project/ash_ai",
"vendor": "ash-project",
"versions": [
{
"lessThan": "9c02de581625c342c9870a672830bff28c1d701e",
"status": "affected",
"version": "2ba234b50946a3b8116190c8467f9f4dfa5edce7",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eReachable only when an application exposes an AshAi read tool over a resource whose field policies restrict a field that the calling actor can still name as an aggregate (for example a \u003ccode\u003epublic? true\u003c/code\u003e but field-policy-protected attribute).\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Reachable only when an application exposes an AshAi read tool over a resource whose field policies restrict a field that the calling actor can still name as an aggregate (for example a `public? true` but field-policy-protected attribute)."
}
],
"value": "Reachable only when an application exposes an AshAi read tool over a resource whose field policies restrict a field that the calling actor can still name as an aggregate (for example a public? true but field-policy-protected attribute)."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_ai:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.0.3",
"versionStartIncluding": "0.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "finder",
"value": "Aaron Hong / Remedy"
}
],
"dateAssigned": "2026-09-08T15:44:25.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAshAi exposes Ash read actions to language-model tool calls. The read tool accepts an aggregate result type (\u003ccode\u003emin\u003c/code\u003e, \u003ccode\u003emax\u003c/code\u003e, \u003ccode\u003esum\u003c/code\u003e, \u003ccode\u003eavg\u003c/code\u003e) that builds an ad-hoc \u003ccode\u003eAsh.Query.Aggregate\u003c/code\u003e over a named field and returns its raw value.\u003c/p\u003e\n\u003cp\u003eAsh field policies redact forbidden fields on returned records (replacing them with \u003ccode\u003e%Ash.ForbiddenField{}\u003c/code\u003e), but that redaction does not apply to aggregate values. A tool caller could therefore read a field the calling actor\u0027s field policies forbid by requesting it as an aggregate; \u003ccode\u003emin\u003c/code\u003e/\u003ccode\u003emax\u003c/code\u003e in particular return an actual field value. This includes fields that are \u003ccode\u003epublic? true\u003c/code\u003e but restricted per-actor by a field policy, such as sensitive PII. The tool\u0027s existing check only required the field to be public, which is a separate axis from per-actor field-policy authorization.\u003c/p\u003e\n\u003cp\u003eThe fix authorizes the aggregated field against the resource\u0027s field policies, so aggregating over a field the actor may not see is refused or scoped to the rows where it is visible.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_ai: from 0.1.0 before 1.0.3.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "AshAi exposes Ash read actions to language-model tool calls. The read tool accepts an aggregate result type (`min`, `max`, `sum`, `avg`) that builds an ad-hoc `Ash.Query.Aggregate` over a named field and returns its raw value.\n\nAsh field policies redact forbidden fields on returned records (replacing them with `%Ash.ForbiddenField{}`), but that redaction does not apply to aggregate values. A tool caller could therefore read a field the calling actor\u0027s field policies forbid by requesting it as an aggregate; `min`/`max` in particular return an actual field value. This includes fields that are `public? true` but restricted per-actor by a field policy, such as sensitive PII. The tool\u0027s existing check only required the field to be public, which is a separate axis from per-actor field-policy authorization.\n\nThe fix authorizes the aggregated field against the resource\u0027s field policies, so aggregating over a field the actor may not see is refused or scoped to the rows where it is visible.\n\nThis issue affects ash_ai: from 0.1.0 before 1.0.3."
}
],
"value": "AshAi exposes Ash read actions to language-model tool calls. The read tool accepts an aggregate result type (min, max, sum, avg) that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value.\n\nAsh field policies redact forbidden fields on returned records (replacing them with %Ash.ForbiddenField{}), but that redaction does not apply to aggregate values. A tool caller could therefore read a field the calling actor\u0027s field policies forbid by requesting it as an aggregate; min/max in particular return an actual field value. This includes fields that are public? true but restricted per-actor by a field policy, such as sensitive PII. The tool\u0027s existing check only required the field to be public, which is a separate axis from per-actor field-policy authorization.\n\nThe fix authorizes the aggregated field against the resource\u0027s field policies, so aggregating over a field the actor may not see is refused or scoped to the rows where it is visible.\n\nThis issue affects ash_ai: from 0.1.0 before 1.0.3."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1220",
"description": "CWE-1220 Insufficient Granularity of Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T16:41:45.975Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "GHSA-v5rw-36x5-r5vx",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/ash-project/ash_ai/security/advisories/GHSA-v5rw-36x5-r5vx"
},
{
"name": "EEF CNA record for CVE-2026-78230",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-78230.html"
},
{
"name": "OSV record EEF-CVE-2026-78230",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-78230"
},
{
"name": "Introducing commit 2ba234b in ash-project/ash_ai",
"tags": [
"related"
],
"url": "https://github.com/ash-project/ash_ai/commit/2ba234b50946a3b8116190c8467f9f4dfa5edce7"
},
{
"name": "Fix commit 9c02de5 in ash-project/ash_ai",
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_ai/commit/9c02de581625c342c9870a672830bff28c1d701e"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "AshAi aggregate tool can read field-policy-protected fields"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-78230",
"datePublished": "2026-09-08T16:41:45.975Z",
"dateReserved": "2026-08-31T00:45:02.439Z",
"dateUpdated": "2026-09-08T17:33:57.604Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78216 (GCVE-0-2026-78216)
Vulnerability from nvd – Published: 2026-09-08 16:42 – Updated: 2026-09-08 17:27
VLAI
EPSS
VEX
Title
AshLua eval read operations can read field-policy-protected fields via aggregates
Summary
AshLua exposes Ash read actions to Lua scripts run through an eval action. A read call accepts an operation (list, min, max, first, sum, avg) that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value.
Ash field policies redact forbidden fields on returned records (replacing them with %Ash.ForbiddenField{}), but that redaction does not apply to aggregate values. A script could therefore read a field the calling actor's field policies forbid by requesting it as an aggregate instead of as a field. This includes fields that are public? true but restricted per-actor by a field policy, such as sensitive PII. The prior hardening only enforced the exposed-field allow-list (field visibility), which is a separate axis from per-actor field-policy authorization.
The fix authorizes the aggregated field against the resource's field policies, so aggregating over a field the actor may not see is refused or scoped to the rows where it is visible.
This issue affects ash_lua: from 0.1.0 before 0.2.2.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 17:26 UTC
CWE
- CWE-1220 - Insufficient Granularity of Access Control
Assigner
References
5 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_lua |
Affected:
0.1.0 , < 0.2.2
(semver)
cpe:2.3:a:ash-project:ash_lua:*:*:*:*:*:*:*:* |
|
| ash-project | ash_lua |
Affected:
8675e47cca81f36594083a7e63379bac9e123e72 , < 266a5dcc56d5015b6d316c10606169e753b07450
(git)
cpe:2.3:a:ash-project:ash_lua:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-78216",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T17:26:34.675766Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T17:27:08.856Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_lua:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshLua.Runtime\u0027"
],
"packageName": "ash_lua",
"packageURL": "pkg:hex/ash_lua",
"product": "ash_lua",
"programFiles": [
"lib/ash_lua/runtime.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshLua.Runtime\u0027:run_read_operation/5"
}
],
"repo": "https://github.com/ash-project/ash_lua",
"vendor": "ash-project",
"versions": [
{
"lessThan": "0.2.2",
"status": "affected",
"version": "0.1.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_lua:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshLua.Runtime\u0027"
],
"packageName": "ash-project/ash_lua",
"packageURL": "pkg:github/ash-project/ash_lua",
"product": "ash_lua",
"programFiles": [
"lib/ash_lua/runtime.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshLua.Runtime\u0027:run_read_operation/5"
}
],
"repo": "https://github.com/ash-project/ash_lua",
"vendor": "ash-project",
"versions": [
{
"lessThan": "266a5dcc56d5015b6d316c10606169e753b07450",
"status": "affected",
"version": "8675e47cca81f36594083a7e63379bac9e123e72",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eReachable only when an application exposes an AshLua \u003ccode\u003eeval\u003c/code\u003e action over a resource whose field policies restrict a field that the calling actor can still name as an operation aggregate (for example a \u003ccode\u003epublic? true\u003c/code\u003e but field-policy-protected attribute).\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Reachable only when an application exposes an AshLua `eval` action over a resource whose field policies restrict a field that the calling actor can still name as an operation aggregate (for example a `public? true` but field-policy-protected attribute)."
}
],
"value": "Reachable only when an application exposes an AshLua eval action over a resource whose field policies restrict a field that the calling actor can still name as an operation aggregate (for example a public? true but field-policy-protected attribute)."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_lua:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.2.2",
"versionStartIncluding": "0.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "finder",
"value": "Aaron Hong / Remedy"
}
],
"dateAssigned": "2026-09-08T15:43:48.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAshLua exposes Ash read actions to Lua scripts run through an \u003ccode\u003eeval\u003c/code\u003e action. A read call accepts an \u003ccode\u003eoperation\u003c/code\u003e (\u003ccode\u003elist\u003c/code\u003e, \u003ccode\u003emin\u003c/code\u003e, \u003ccode\u003emax\u003c/code\u003e, \u003ccode\u003efirst\u003c/code\u003e, \u003ccode\u003esum\u003c/code\u003e, \u003ccode\u003eavg\u003c/code\u003e) that builds an ad-hoc \u003ccode\u003eAsh.Query.Aggregate\u003c/code\u003e over a named field and returns its raw value.\u003c/p\u003e\n\u003cp\u003eAsh field policies redact forbidden fields on returned records (replacing them with \u003ccode\u003e%Ash.ForbiddenField{}\u003c/code\u003e), but that redaction does not apply to aggregate values. A script could therefore read a field the calling actor\u0027s field policies forbid by requesting it as an aggregate instead of as a field. This includes fields that are \u003ccode\u003epublic? true\u003c/code\u003e but restricted per-actor by a field policy, such as sensitive PII. The prior hardening only enforced the exposed-field allow-list (field visibility), which is a separate axis from per-actor field-policy authorization.\u003c/p\u003e\n\u003cp\u003eThe fix authorizes the aggregated field against the resource\u0027s field policies, so aggregating over a field the actor may not see is refused or scoped to the rows where it is visible.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_lua: from 0.1.0 before 0.2.2.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "AshLua exposes Ash read actions to Lua scripts run through an `eval` action. A read call accepts an `operation` (`list`, `min`, `max`, `first`, `sum`, `avg`) that builds an ad-hoc `Ash.Query.Aggregate` over a named field and returns its raw value.\n\nAsh field policies redact forbidden fields on returned records (replacing them with `%Ash.ForbiddenField{}`), but that redaction does not apply to aggregate values. A script could therefore read a field the calling actor\u0027s field policies forbid by requesting it as an aggregate instead of as a field. This includes fields that are `public? true` but restricted per-actor by a field policy, such as sensitive PII. The prior hardening only enforced the exposed-field allow-list (field visibility), which is a separate axis from per-actor field-policy authorization.\n\nThe fix authorizes the aggregated field against the resource\u0027s field policies, so aggregating over a field the actor may not see is refused or scoped to the rows where it is visible.\n\nThis issue affects ash_lua: from 0.1.0 before 0.2.2."
}
],
"value": "AshLua exposes Ash read actions to Lua scripts run through an eval action. A read call accepts an operation (list, min, max, first, sum, avg) that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value.\n\nAsh field policies redact forbidden fields on returned records (replacing them with %Ash.ForbiddenField{}), but that redaction does not apply to aggregate values. A script could therefore read a field the calling actor\u0027s field policies forbid by requesting it as an aggregate instead of as a field. This includes fields that are public? true but restricted per-actor by a field policy, such as sensitive PII. The prior hardening only enforced the exposed-field allow-list (field visibility), which is a separate axis from per-actor field-policy authorization.\n\nThe fix authorizes the aggregated field against the resource\u0027s field policies, so aggregating over a field the actor may not see is refused or scoped to the rows where it is visible.\n\nThis issue affects ash_lua: from 0.1.0 before 0.2.2."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1220",
"description": "CWE-1220 Insufficient Granularity of Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T16:42:20.908Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "GHSA-5whv-8rcp-x33j",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/ash-project/ash_lua/security/advisories/GHSA-5whv-8rcp-x33j"
},
{
"name": "EEF CNA record for CVE-2026-78216",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-78216.html"
},
{
"name": "OSV record EEF-CVE-2026-78216",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-78216"
},
{
"name": "Introducing commit 8675e47 in ash-project/ash_lua",
"tags": [
"related"
],
"url": "https://github.com/ash-project/ash_lua/commit/8675e47cca81f36594083a7e63379bac9e123e72"
},
{
"name": "Fix commit 266a5dc in ash-project/ash_lua",
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_lua/commit/266a5dcc56d5015b6d316c10606169e753b07450"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "AshLua eval read operations can read field-policy-protected fields via aggregates"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-78216",
"datePublished": "2026-09-08T16:42:20.908Z",
"dateReserved": "2026-08-31T00:45:02.446Z",
"dateUpdated": "2026-09-08T17:27:08.856Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82710 (GCVE-0-2026-82710)
Vulnerability from nvd – Published: 2026-09-08 00:23 – Updated: 2026-09-08 14:45
VLAI
EPSS
VEX
Title
Terminal escape sequence injection in mix usage_rules.search_docs via package documentation metadata
Summary
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project usage_rules allows a malicious package publisher to inject terminal control sequences into the output of mix usage_rules.search_docs.
mix usage_rules.search_docs searches Hex documentation through search.hexdocs.pm, which indexes the documentation of every published package, and prints the matching results (title, package, type, doc reference, and highlighted snippets) to the terminal. The formatter in Mix.Tasks.UsageRules.SearchDocs interpolated those publisher-controlled fields verbatim, neutralizing no terminal control characters; the only transform it applied adds escape sequences rather than removing them. A malicious package can embed ANSI terminal escape sequences (cursor movement, line erase, carriage returns, OSC 52 clipboard writes) in its indexed documentation, so when a developer runs a search that surfaces those docs the sequences reach the terminal unchanged — forging the displayed hexdocs URL or a suggested command, hiding text, or writing to the clipboard. No authentication or privileged position is required; only publishing a package.
This issue affects usage_rules: from 0.1.18 before 1.2.8.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 14:45 UTC
CWE
- CWE-150 - Improper Neutralization of Escape, Meta, or Control Sequences
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/usage_rules/securi… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82710.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82710 | related |
| https://github.com/ash-project/usage_rules/commit… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | usage_rules |
Affected:
0.1.18 , < 1.2.8
(semver)
cpe:2.3:a:ash-project:usage_rules:*:*:*:*:*:*:*:* |
|
| ash-project | usage_rules |
Affected:
2da7a99536041d63ec1f391d019565789a59595f , < 3b8ebb4117d3272bbd436e6c2432113ba6685dbb
(git)
cpe:2.3:a:ash-project:usage_rules:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82710",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T14:45:15.853850Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T14:45:23.177Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:usage_rules:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Mix.Tasks.UsageRules.SearchDocs\u0027"
],
"packageName": "usage_rules",
"packageURL": "pkg:hex/usage_rules",
"product": "usage_rules",
"programFiles": [
"lib/mix/tasks/usage_rules.search_docs.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Mix.Tasks.UsageRules.SearchDocs\u0027:format_search_result_markdown/4"
}
],
"repo": "https://github.com/ash-project/usage_rules",
"vendor": "ash-project",
"versions": [
{
"lessThan": "1.2.8",
"status": "affected",
"version": "0.1.18",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:usage_rules:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Mix.Tasks.UsageRules.SearchDocs\u0027"
],
"packageName": "ash-project/usage_rules",
"packageURL": "pkg:github/ash-project/usage_rules",
"product": "usage_rules",
"programFiles": [
"lib/mix/tasks/usage_rules.search_docs.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Mix.Tasks.UsageRules.SearchDocs\u0027:format_search_result_markdown/4"
}
],
"repo": "https://github.com/ash-project/usage_rules",
"vendor": "ash-project",
"versions": [
{
"lessThan": "3b8ebb4117d3272bbd436e6c2432113ba6685dbb",
"status": "affected",
"version": "2da7a99536041d63ec1f391d019565789a59595f",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eReachable only when a developer runs \u003ccode\u003emix usage_rules.search_docs\u003c/code\u003e in a terminal emulator that interprets ANSI escape sequences and the results include documentation from an attacker-published package (for example a broad \u003ccode\u003e--everywhere\u003c/code\u003e search).\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Reachable only when a developer runs `mix usage_rules.search_docs` in a terminal emulator that interprets ANSI escape sequences and the results include documentation from an attacker-published package (for example a broad `--everywhere` search)."
}
],
"value": "Reachable only when a developer runs mix usage_rules.search_docs in a terminal emulator that interprets ANSI escape sequences and the results include documentation from an attacker-published package (for example a broad --everywhere search)."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:usage_rules:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.2.8",
"versionStartIncluding": "0.1.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project usage_rules allows a malicious package publisher to inject terminal control sequences into the output of \u003ccode\u003emix usage_rules.search_docs\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003emix usage_rules.search_docs\u003c/code\u003e searches Hex documentation through \u003ccode\u003esearch.hexdocs.pm\u003c/code\u003e, which indexes the documentation of every published package, and prints the matching results (title, package, type, doc reference, and highlighted snippets) to the terminal. The formatter in \u003ccode\u003eMix.Tasks.UsageRules.SearchDocs\u003c/code\u003e interpolated those publisher-controlled fields verbatim, neutralizing no terminal control characters; the only transform it applied adds escape sequences rather than removing them. A malicious package can embed ANSI terminal escape sequences (cursor movement, line erase, carriage returns, OSC 52 clipboard writes) in its indexed documentation, so when a developer runs a search that surfaces those docs the sequences reach the terminal unchanged \u2014 forging the displayed hexdocs URL or a suggested command, hiding text, or writing to the clipboard. No authentication or privileged position is required; only publishing a package.\u003c/p\u003e\n\u003cp\u003eThis issue affects usage_rules: from 0.1.18 before 1.2.8.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project usage_rules allows a malicious package publisher to inject terminal control sequences into the output of `mix usage_rules.search_docs`.\n\n`mix usage_rules.search_docs` searches Hex documentation through `search.hexdocs.pm`, which indexes the documentation of every published package, and prints the matching results (title, package, type, doc reference, and highlighted snippets) to the terminal. The formatter in `Mix.Tasks.UsageRules.SearchDocs` interpolated those publisher-controlled fields verbatim, neutralizing no terminal control characters; the only transform it applied adds escape sequences rather than removing them. A malicious package can embed ANSI terminal escape sequences (cursor movement, line erase, carriage returns, OSC 52 clipboard writes) in its indexed documentation, so when a developer runs a search that surfaces those docs the sequences reach the terminal unchanged \u2014 forging the displayed hexdocs URL or a suggested command, hiding text, or writing to the clipboard. No authentication or privileged position is required; only publishing a package.\n\nThis issue affects usage_rules: from 0.1.18 before 1.2.8."
}
],
"value": "Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project usage_rules allows a malicious package publisher to inject terminal control sequences into the output of mix usage_rules.search_docs.\n\nmix usage_rules.search_docs searches Hex documentation through search.hexdocs.pm, which indexes the documentation of every published package, and prints the matching results (title, package, type, doc reference, and highlighted snippets) to the terminal. The formatter in Mix.Tasks.UsageRules.SearchDocs interpolated those publisher-controlled fields verbatim, neutralizing no terminal control characters; the only transform it applied adds escape sequences rather than removing them. A malicious package can embed ANSI terminal escape sequences (cursor movement, line erase, carriage returns, OSC 52 clipboard writes) in its indexed documentation, so when a developer runs a search that surfaces those docs the sequences reach the terminal unchanged \u2014 forging the displayed hexdocs URL or a suggested command, hiding text, or writing to the clipboard. No authentication or privileged position is required; only publishing a package.\n\nThis issue affects usage_rules: from 0.1.18 before 1.2.8."
}
],
"impacts": [
{
"capecId": "CAPEC-93",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-93 Log Injection-Tampering-Forging"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-150",
"description": "CWE-150 Improper Neutralization of Escape, Meta, or Control Sequences",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T00:23:36.912Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/usage_rules/security/advisories/GHSA-j59f-776f-23hp"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82710.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82710"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/usage_rules/commit/3b8ebb4117d3272bbd436e6c2432113ba6685dbb"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Terminal escape sequence injection in mix usage_rules.search_docs via package documentation metadata"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82710",
"datePublished": "2026-09-08T00:23:36.912Z",
"dateReserved": "2026-09-07T20:30:01.990Z",
"dateUpdated": "2026-09-08T14:45:23.177Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82758 (GCVE-0-2026-82758)
Vulnerability from nvd – Published: 2026-09-07 22:32 – Updated: 2026-09-08 14:41
VLAI
EPSS
VEX
Title
ash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gated Dynamic Client Registration endpoint
Summary
Improper Authentication vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token.
resolve_secret/3 in AshAuthentication.Oauth2Server (reached through __resolve_secret__!) treated any return other than {:ok, _} or :error from a configured {module, function, args} or 2-arity-function secret provider as a valid secret, wrapping nil, false, or "" as {:ok, value}. When the initial_access_token resolves to such an empty value, POST /oauth/register compares the presented bearer token against it and the comparison passes with no token supplied, so registration is open although it was configured closed. The same fail-open affected other resolved secrets such as signing_secret.
This issue affects ash_authentication_oauth2_server: from 0.1.0 before 0.3.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 14:40 UTC
CWE
- CWE-287 - Improper Authentication
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash_authentication… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82758.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82758 | related |
| https://github.com/ash-project/ash_authentication… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_authentication_oauth2_server |
Affected:
0.1.0 , < 0.3.1
(semver)
cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:* |
|
| ash-project | ash_authentication_oauth2_server |
Affected:
855b578037c5ded18e8a6e60f42e56bde4905fae , < 30a87101871775d27d79f9ad6f29eafa4779e118
(git)
cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82758",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T14:40:53.437993Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T14:41:06.227Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAuthentication.Oauth2Server\u0027"
],
"packageName": "ash_authentication_oauth2_server",
"packageURL": "pkg:hex/ash_authentication_oauth2_server",
"product": "ash_authentication_oauth2_server",
"programFiles": [
"lib/ash_authentication/oauth2_server.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAuthentication.Oauth2Server\u0027:__resolve_secret__!/3"
}
],
"repo": "https://github.com/ash-project/ash_authentication_oauth2_server",
"vendor": "ash-project",
"versions": [
{
"lessThan": "0.3.1",
"status": "affected",
"version": "0.1.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAuthentication.Oauth2Server\u0027"
],
"packageName": "ash-project/ash_authentication_oauth2_server",
"packageURL": "pkg:github/ash-project/ash_authentication_oauth2_server",
"product": "ash_authentication_oauth2_server",
"programFiles": [
"lib/ash_authentication/oauth2_server.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAuthentication.Oauth2Server\u0027:__resolve_secret__!/3"
}
],
"repo": "https://github.com/ash-project/ash_authentication_oauth2_server",
"vendor": "ash-project",
"versions": [
{
"lessThan": "30a87101871775d27d79f9ad6f29eafa4779e118",
"status": "affected",
"version": "855b578037c5ded18e8a6e60f42e56bde4905fae",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eReachable only when the server configures an \u003ccode\u003einitial_access_token\u003c/code\u003e (so Dynamic Client Registration is meant to require one) and the configured secret provider returns an empty value (\u003ccode\u003enil\u003c/code\u003e, \u003ccode\u003efalse\u003c/code\u003e, or \u003ccode\u003e\"\"\u003c/code\u003e) or an \u003ccode\u003e{:error, _}\u003c/code\u003e for it, rather than a non-empty binary.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Reachable only when the server configures an `initial_access_token` (so Dynamic Client Registration is meant to require one) and the configured secret provider returns an empty value (`nil`, `false`, or `\"\"`) or an `{:error, _}` for it, rather than a non-empty binary."
}
],
"value": "Reachable only when the server configures an initial_access_token (so Dynamic Client Registration is meant to require one) and the configured secret provider returns an empty value (nil, false, or \"\") or an {:error, _} for it, rather than a non-empty binary."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.3.1",
"versionStartIncluding": "0.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Authentication vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eresolve_secret/3\u003c/code\u003e in \u003ccode\u003eAshAuthentication.Oauth2Server\u003c/code\u003e (reached through \u003ccode\u003e__resolve_secret__!\u003c/code\u003e) treated any return other than \u003ccode\u003e{:ok, _}\u003c/code\u003e or \u003ccode\u003e:error\u003c/code\u003e from a configured \u003ccode\u003e{module, function, args}\u003c/code\u003e or 2-arity-function secret provider as a valid secret, wrapping \u003ccode\u003enil\u003c/code\u003e, \u003ccode\u003efalse\u003c/code\u003e, or \u003ccode\u003e\"\"\u003c/code\u003e as \u003ccode\u003e{:ok, value}\u003c/code\u003e. When the \u003ccode\u003einitial_access_token\u003c/code\u003e resolves to such an empty value, \u003ccode\u003ePOST /oauth/register\u003c/code\u003e compares the presented bearer token against it and the comparison passes with no token supplied, so registration is open although it was configured closed. The same fail-open affected other resolved secrets such as \u003ccode\u003esigning_secret\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_authentication_oauth2_server: from 0.1.0 before 0.3.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Improper Authentication vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token.\n\n`resolve_secret/3` in `AshAuthentication.Oauth2Server` (reached through `__resolve_secret__!`) treated any return other than `{:ok, _}` or `:error` from a configured `{module, function, args}` or 2-arity-function secret provider as a valid secret, wrapping `nil`, `false`, or `\"\"` as `{:ok, value}`. When the `initial_access_token` resolves to such an empty value, `POST /oauth/register` compares the presented bearer token against it and the comparison passes with no token supplied, so registration is open although it was configured closed. The same fail-open affected other resolved secrets such as `signing_secret`.\n\nThis issue affects ash_authentication_oauth2_server: from 0.1.0 before 0.3.1."
}
],
"value": "Improper Authentication vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token.\n\nresolve_secret/3 in AshAuthentication.Oauth2Server (reached through __resolve_secret__!) treated any return other than {:ok, _} or :error from a configured {module, function, args} or 2-arity-function secret provider as a valid secret, wrapping nil, false, or \"\" as {:ok, value}. When the initial_access_token resolves to such an empty value, POST /oauth/register compares the presented bearer token against it and the comparison passes with no token supplied, so registration is open although it was configured closed. The same fail-open affected other resolved secrets such as signing_secret.\n\nThis issue affects ash_authentication_oauth2_server: from 0.1.0 before 0.3.1."
}
],
"impacts": [
{
"capecId": "CAPEC-115",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-115 Authentication Bypass"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287 Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T22:32:17.027Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash_authentication_oauth2_server/security/advisories/GHSA-fxc6-vp68-87pw"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82758.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82758"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_authentication_oauth2_server/commit/30a87101871775d27d79f9ad6f29eafa4779e118"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "ash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gated Dynamic Client Registration endpoint"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82758",
"datePublished": "2026-09-07T22:32:17.027Z",
"dateReserved": "2026-08-31T01:00:10.817Z",
"dateUpdated": "2026-09-08T14:41:06.227Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82757 (GCVE-0-2026-82757)
Vulnerability from nvd – Published: 2026-09-07 22:31 – Updated: 2026-09-08 14:43
VLAI
EPSS
VEX
Title
ash_authentication_oauth2_server CIMD fetcher classifies IPv4-in-IPv6 and site-local addresses as public, allowing SSRF
Summary
Server-Side Request Forgery (SSRF) vulnerability in ash-project ash_authentication_oauth2_server allows an attacker who controls a client metadata URL and its DNS to make the server connect to internal or loopback addresses.
public_ip?/1 in AshAuthentication.Oauth2Server.CIMD.ReqFetcher enforces the outbound policy for CIMD metadata fetches. It classified several address forms as publicly routable that are not: IPv4-compatible ::/96 (for example ::127.0.0.1), SIIT IPv4-translated ::ffff:0:0:0/96, and deprecated site-local fec0::/10. A returned AAAA record in one of these ranges passed the policy, so a fetch pinned to that address reached space the policy was meant to block.
This issue affects ash_authentication_oauth2_server: from 0.3.0 before 0.3.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 14:43 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash_authentication… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82757.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82757 | related |
| https://github.com/ash-project/ash_authentication… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_authentication_oauth2_server |
Affected:
0.3.0 , < 0.3.1
(semver)
cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:* |
|
| ash-project | ash_authentication_oauth2_server |
Affected:
e713a9ba816761140c226e2ca55b75c0b93f5984 , < 268b591261a3473ab9b87272963e4dd2fd99d972
(git)
cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82757",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T14:43:50.818031Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T14:43:57.511Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAuthentication.Oauth2Server.CIMD.ReqFetcher\u0027"
],
"packageName": "ash_authentication_oauth2_server",
"packageURL": "pkg:hex/ash_authentication_oauth2_server",
"product": "ash_authentication_oauth2_server",
"programFiles": [
"lib/ash_authentication/oauth2_server/cimd/req_fetcher.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAuthentication.Oauth2Server.CIMD.ReqFetcher\u0027:public_ip?/1"
},
{
"name": "\u0027Elixir.AshAuthentication.Oauth2Server.CIMD.ReqFetcher\u0027:fetch/2"
}
],
"repo": "https://github.com/ash-project/ash_authentication_oauth2_server",
"vendor": "ash-project",
"versions": [
{
"lessThan": "0.3.1",
"status": "affected",
"version": "0.3.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAuthentication.Oauth2Server.CIMD.ReqFetcher\u0027"
],
"packageName": "ash-project/ash_authentication_oauth2_server",
"packageURL": "pkg:github/ash-project/ash_authentication_oauth2_server",
"product": "ash_authentication_oauth2_server",
"programFiles": [
"lib/ash_authentication/oauth2_server/cimd/req_fetcher.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAuthentication.Oauth2Server.CIMD.ReqFetcher\u0027:public_ip?/1"
},
{
"name": "\u0027Elixir.AshAuthentication.Oauth2Server.CIMD.ReqFetcher\u0027:fetch/2"
}
],
"repo": "https://github.com/ash-project/ash_authentication_oauth2_server",
"vendor": "ash-project",
"versions": [
{
"lessThan": "268b591261a3473ab9b87272963e4dd2fd99d972",
"status": "affected",
"version": "e713a9ba816761140c226e2ca55b75c0b93f5984",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eReachable only when Client ID Metadata Documents are enabled (\u003ccode\u003ecimd_enabled?: true\u003c/code\u003e), so the authorize endpoint fetches attacker-suppliable metadata URLs, and an internal or loopback target resolves to one of the affected IPv6 address forms.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Reachable only when Client ID Metadata Documents are enabled (`cimd_enabled?: true`), so the authorize endpoint fetches attacker-suppliable metadata URLs, and an internal or loopback target resolves to one of the affected IPv6 address forms."
}
],
"value": "Reachable only when Client ID Metadata Documents are enabled (cimd_enabled?: true), so the authorize endpoint fetches attacker-suppliable metadata URLs, and an internal or loopback target resolves to one of the affected IPv6 address forms."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.3.1",
"versionStartIncluding": "0.3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eServer-Side Request Forgery (SSRF) vulnerability in ash-project ash_authentication_oauth2_server allows an attacker who controls a client metadata URL and its DNS to make the server connect to internal or loopback addresses.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003epublic_ip?/1\u003c/code\u003e in \u003ccode\u003eAshAuthentication.Oauth2Server.CIMD.ReqFetcher\u003c/code\u003e enforces the outbound policy for CIMD metadata fetches. It classified several address forms as publicly routable that are not: IPv4-compatible \u003ccode\u003e::/96\u003c/code\u003e (for example \u003ccode\u003e::127.0.0.1\u003c/code\u003e), SIIT IPv4-translated \u003ccode\u003e::ffff:0:0:0/96\u003c/code\u003e, and deprecated site-local \u003ccode\u003efec0::/10\u003c/code\u003e. A returned AAAA record in one of these ranges passed the policy, so a fetch pinned to that address reached space the policy was meant to block.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_authentication_oauth2_server: from 0.3.0 before 0.3.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Server-Side Request Forgery (SSRF) vulnerability in ash-project ash_authentication_oauth2_server allows an attacker who controls a client metadata URL and its DNS to make the server connect to internal or loopback addresses.\n\n`public_ip?/1` in `AshAuthentication.Oauth2Server.CIMD.ReqFetcher` enforces the outbound policy for CIMD metadata fetches. It classified several address forms as publicly routable that are not: IPv4-compatible `::/96` (for example `::127.0.0.1`), SIIT IPv4-translated `::ffff:0:0:0/96`, and deprecated site-local `fec0::/10`. A returned AAAA record in one of these ranges passed the policy, so a fetch pinned to that address reached space the policy was meant to block.\n\nThis issue affects ash_authentication_oauth2_server: from 0.3.0 before 0.3.1."
}
],
"value": "Server-Side Request Forgery (SSRF) vulnerability in ash-project ash_authentication_oauth2_server allows an attacker who controls a client metadata URL and its DNS to make the server connect to internal or loopback addresses.\n\npublic_ip?/1 in AshAuthentication.Oauth2Server.CIMD.ReqFetcher enforces the outbound policy for CIMD metadata fetches. It classified several address forms as publicly routable that are not: IPv4-compatible ::/96 (for example ::127.0.0.1), SIIT IPv4-translated ::ffff:0:0:0/96, and deprecated site-local fec0::/10. A returned AAAA record in one of these ranges passed the policy, so a fetch pinned to that address reached space the policy was meant to block.\n\nThis issue affects ash_authentication_oauth2_server: from 0.3.0 before 0.3.1."
}
],
"impacts": [
{
"capecId": "CAPEC-664",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-664 Server Side Request Forgery"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T22:31:34.656Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash_authentication_oauth2_server/security/advisories/GHSA-wprp-8gvj-p6cv"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82757.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82757"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_authentication_oauth2_server/commit/268b591261a3473ab9b87272963e4dd2fd99d972"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "ash_authentication_oauth2_server CIMD fetcher classifies IPv4-in-IPv6 and site-local addresses as public, allowing SSRF"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82757",
"datePublished": "2026-09-07T22:31:34.656Z",
"dateReserved": "2026-08-31T01:00:10.817Z",
"dateUpdated": "2026-09-08T14:43:57.511Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82756 (GCVE-0-2026-82756)
Vulnerability from nvd – Published: 2026-09-07 22:30 – Updated: 2026-09-08 14:43
VLAI
EPSS
VEX
Title
ash_authentication_oauth2_server interpolates a tenant-derived value into the WWW-Authenticate challenge without escaping, allowing header parameter injection
Summary
Improper Encoding or Escaping of Output vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to inject arbitrary authentication parameters into the WWW-Authenticate challenge header.
BearerPlug and RequireScopePlug built the Bearer resource_metadata="..." challenge by interpolating a resource_metadata URL derived from the request tenant directly into the quoted value. In a multi-tenant application that sets the Ash tenant from request-controlled data (a subdomain, the Host, a path segment, or a header), a tenant containing a " closes the quoted value and appends attacker-chosen auth-params, including a second resource_metadata URL pointing at an attacker-controlled authorization server that spec-following clients follow. Carriage returns and line feeds are rejected by Plug, so this is parameter injection within one header, not response splitting.
This issue affects ash_authentication_oauth2_server: from 0.1.3 before 0.3.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 14:43 UTC
CWE
- CWE-116 - Improper Encoding or Escaping of Output
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash_authentication… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82756.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82756 | related |
| https://github.com/ash-project/ash_authentication… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_authentication_oauth2_server |
Affected:
0.1.3 , < 0.3.1
(semver)
cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:* |
|
| ash-project | ash_authentication_oauth2_server |
Affected:
99de0a1cacb5ef667c4533278b7c81ca98c00231 , < 09f97476715da031b136eaec7b2cda2363ad8149
(git)
cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82756",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T14:43:23.093058Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T14:43:33.571Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.BearerPlug\u0027",
"\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.RequireScopePlug\u0027"
],
"packageName": "ash_authentication_oauth2_server",
"packageURL": "pkg:hex/ash_authentication_oauth2_server",
"product": "ash_authentication_oauth2_server",
"programFiles": [
"lib/ash_authentication_phoenix/oauth2_server/bearer_plug.ex",
"lib/ash_authentication_phoenix/oauth2_server/require_scope_plug.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.BearerPlug\u0027:call/2"
},
{
"name": "\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.RequireScopePlug\u0027:call/2"
}
],
"repo": "https://github.com/ash-project/ash_authentication_oauth2_server",
"vendor": "ash-project",
"versions": [
{
"lessThan": "0.3.1",
"status": "affected",
"version": "0.1.3",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.BearerPlug\u0027",
"\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.RequireScopePlug\u0027"
],
"packageName": "ash-project/ash_authentication_oauth2_server",
"packageURL": "pkg:github/ash-project/ash_authentication_oauth2_server",
"product": "ash_authentication_oauth2_server",
"programFiles": [
"lib/ash_authentication_phoenix/oauth2_server/bearer_plug.ex",
"lib/ash_authentication_phoenix/oauth2_server/require_scope_plug.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.BearerPlug\u0027:call/2"
},
{
"name": "\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.RequireScopePlug\u0027:call/2"
}
],
"repo": "https://github.com/ash-project/ash_authentication_oauth2_server",
"vendor": "ash-project",
"versions": [
{
"lessThan": "09f97476715da031b136eaec7b2cda2363ad8149",
"status": "affected",
"version": "99de0a1cacb5ef667c4533278b7c81ca98c00231",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eReachable only in a multi-tenant application that derives the Ash tenant from request-controlled input (subdomain, \u003ccode\u003eHost\u003c/code\u003e, path, or header) and uses \u003ccode\u003eBearerPlug\u003c/code\u003e or \u003ccode\u003eRequireScopePlug\u003c/code\u003e; the tenant reaches the challenge through the server\u0027s tenant-aware \u003ccode\u003eresource_url\u003c/code\u003e.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Reachable only in a multi-tenant application that derives the Ash tenant from request-controlled input (subdomain, `Host`, path, or header) and uses `BearerPlug` or `RequireScopePlug`; the tenant reaches the challenge through the server\u0027s tenant-aware `resource_url`."
}
],
"value": "Reachable only in a multi-tenant application that derives the Ash tenant from request-controlled input (subdomain, Host, path, or header) and uses BearerPlug or RequireScopePlug; the tenant reaches the challenge through the server\u0027s tenant-aware resource_url."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.3.1",
"versionStartIncluding": "0.1.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Encoding or Escaping of Output vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to inject arbitrary authentication parameters into the \u003ccode\u003eWWW-Authenticate\u003c/code\u003e challenge header.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eBearerPlug\u003c/code\u003e and \u003ccode\u003eRequireScopePlug\u003c/code\u003e built the \u003ccode\u003eBearer resource_metadata=\"...\"\u003c/code\u003e challenge by interpolating a \u003ccode\u003eresource_metadata\u003c/code\u003e URL derived from the request tenant directly into the quoted value. In a multi-tenant application that sets the Ash tenant from request-controlled data (a subdomain, the \u003ccode\u003eHost\u003c/code\u003e, a path segment, or a header), a tenant containing a \u003ccode\u003e\"\u003c/code\u003e closes the quoted value and appends attacker-chosen auth-params, including a second \u003ccode\u003eresource_metadata\u003c/code\u003e URL pointing at an attacker-controlled authorization server that spec-following clients follow. Carriage returns and line feeds are rejected by Plug, so this is parameter injection within one header, not response splitting.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_authentication_oauth2_server: from 0.1.3 before 0.3.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Improper Encoding or Escaping of Output vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to inject arbitrary authentication parameters into the `WWW-Authenticate` challenge header.\n\n`BearerPlug` and `RequireScopePlug` built the `Bearer resource_metadata=\"...\"` challenge by interpolating a `resource_metadata` URL derived from the request tenant directly into the quoted value. In a multi-tenant application that sets the Ash tenant from request-controlled data (a subdomain, the `Host`, a path segment, or a header), a tenant containing a `\"` closes the quoted value and appends attacker-chosen auth-params, including a second `resource_metadata` URL pointing at an attacker-controlled authorization server that spec-following clients follow. Carriage returns and line feeds are rejected by Plug, so this is parameter injection within one header, not response splitting.\n\nThis issue affects ash_authentication_oauth2_server: from 0.1.3 before 0.3.1."
}
],
"value": "Improper Encoding or Escaping of Output vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to inject arbitrary authentication parameters into the WWW-Authenticate challenge header.\n\nBearerPlug and RequireScopePlug built the Bearer resource_metadata=\"...\" challenge by interpolating a resource_metadata URL derived from the request tenant directly into the quoted value. In a multi-tenant application that sets the Ash tenant from request-controlled data (a subdomain, the Host, a path segment, or a header), a tenant containing a \" closes the quoted value and appends attacker-chosen auth-params, including a second resource_metadata URL pointing at an attacker-controlled authorization server that spec-following clients follow. Carriage returns and line feeds are rejected by Plug, so this is parameter injection within one header, not response splitting.\n\nThis issue affects ash_authentication_oauth2_server: from 0.1.3 before 0.3.1."
}
],
"impacts": [
{
"capecId": "CAPEC-153",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-153 Input Data Manipulation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-116",
"description": "CWE-116 Improper Encoding or Escaping of Output",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T22:30:55.280Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash_authentication_oauth2_server/security/advisories/GHSA-2h3v-83jg-2qmm"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82756.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82756"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_authentication_oauth2_server/commit/09f97476715da031b136eaec7b2cda2363ad8149"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "ash_authentication_oauth2_server interpolates a tenant-derived value into the WWW-Authenticate challenge without escaping, allowing header parameter injection"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82756",
"datePublished": "2026-09-07T22:30:55.280Z",
"dateReserved": "2026-08-31T01:00:10.817Z",
"dateUpdated": "2026-09-08T14:43:33.571Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82755 (GCVE-0-2026-82755)
Vulnerability from nvd – Published: 2026-09-07 22:28 – Updated: 2026-09-08 14:42
VLAI
EPSS
VEX
Title
ash_authentication_oauth2_server serves tenant-specific OAuth metadata as publicly cacheable without Vary, enabling cross-tenant confusion
Summary
Use of Cache Containing Sensitive Information vulnerability in ash-project ash_authentication_oauth2_server allows a shared HTTP cache to serve one tenant's OAuth discovery metadata to another tenant's clients.
The RFC 8414 and RFC 9728 metadata endpoints in AshAuthentication.Phoenix.Oauth2Server.ProtocolRouter return tenant-specific values (issuer, authorization_endpoint, token_endpoint, jwks_uri) when a tenant is set, but sent them with Cache-Control: public, max-age=3600 and no Vary. When the tenant is derived from something other than the URL (a header or the Host) and a shared cache sits in front, the cache key is the URL alone, so a stored response for one tenant is served to another for up to an hour. Affected clients may then send authorization codes and secrets to the wrong tenant's token endpoint and validate tokens against the wrong keys.
This issue affects ash_authentication_oauth2_server: from 0.1.3 before 0.3.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 14:42 UTC
CWE
- CWE-524 - Use of Cache Containing Sensitive Information
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash_authentication… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82755.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82755 | related |
| https://github.com/ash-project/ash_authentication… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_authentication_oauth2_server |
Affected:
0.1.3 , < 0.3.1
(semver)
cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:* |
|
| ash-project | ash_authentication_oauth2_server |
Affected:
99de0a1cacb5ef667c4533278b7c81ca98c00231 , < 768d87f70e4e97ae1d2bf1606b5bf3f4d03f24a1
(git)
cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82755",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T14:42:10.746522Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T14:42:17.718Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.ProtocolRouter\u0027"
],
"packageName": "ash_authentication_oauth2_server",
"packageURL": "pkg:hex/ash_authentication_oauth2_server",
"product": "ash_authentication_oauth2_server",
"programFiles": [
"lib/ash_authentication_phoenix/oauth2_server/protocol_router.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.ProtocolRouter\u0027:call/2"
}
],
"repo": "https://github.com/ash-project/ash_authentication_oauth2_server",
"vendor": "ash-project",
"versions": [
{
"lessThan": "0.3.1",
"status": "affected",
"version": "0.1.3",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.ProtocolRouter\u0027"
],
"packageName": "ash-project/ash_authentication_oauth2_server",
"packageURL": "pkg:github/ash-project/ash_authentication_oauth2_server",
"product": "ash_authentication_oauth2_server",
"programFiles": [
"lib/ash_authentication_phoenix/oauth2_server/protocol_router.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.ProtocolRouter\u0027:call/2"
}
],
"repo": "https://github.com/ash-project/ash_authentication_oauth2_server",
"vendor": "ash-project",
"versions": [
{
"lessThan": "768d87f70e4e97ae1d2bf1606b5bf3f4d03f24a1",
"status": "affected",
"version": "99de0a1cacb5ef667c4533278b7c81ca98c00231",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eReachable only in a multi-tenant deployment where the tenant is derived from outside the request URL (a header or the \u003ccode\u003eHost\u003c/code\u003e) and a shared HTTP cache (CDN, reverse proxy) sits in front of the metadata endpoints.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Reachable only in a multi-tenant deployment where the tenant is derived from outside the request URL (a header or the `Host`) and a shared HTTP cache (CDN, reverse proxy) sits in front of the metadata endpoints."
}
],
"value": "Reachable only in a multi-tenant deployment where the tenant is derived from outside the request URL (a header or the Host) and a shared HTTP cache (CDN, reverse proxy) sits in front of the metadata endpoints."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.3.1",
"versionStartIncluding": "0.1.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUse of Cache Containing Sensitive Information vulnerability in ash-project ash_authentication_oauth2_server allows a shared HTTP cache to serve one tenant\u0027s OAuth discovery metadata to another tenant\u0027s clients.\u003c/p\u003e\n\u003cp\u003eThe RFC 8414 and RFC 9728 metadata endpoints in \u003ccode\u003eAshAuthentication.Phoenix.Oauth2Server.ProtocolRouter\u003c/code\u003e return tenant-specific values (\u003ccode\u003eissuer\u003c/code\u003e, \u003ccode\u003eauthorization_endpoint\u003c/code\u003e, \u003ccode\u003etoken_endpoint\u003c/code\u003e, \u003ccode\u003ejwks_uri\u003c/code\u003e) when a tenant is set, but sent them with \u003ccode\u003eCache-Control: public, max-age=3600\u003c/code\u003e and no \u003ccode\u003eVary\u003c/code\u003e. When the tenant is derived from something other than the URL (a header or the \u003ccode\u003eHost\u003c/code\u003e) and a shared cache sits in front, the cache key is the URL alone, so a stored response for one tenant is served to another for up to an hour. Affected clients may then send authorization codes and secrets to the wrong tenant\u0027s token endpoint and validate tokens against the wrong keys.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_authentication_oauth2_server: from 0.1.3 before 0.3.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Use of Cache Containing Sensitive Information vulnerability in ash-project ash_authentication_oauth2_server allows a shared HTTP cache to serve one tenant\u0027s OAuth discovery metadata to another tenant\u0027s clients.\n\nThe RFC 8414 and RFC 9728 metadata endpoints in `AshAuthentication.Phoenix.Oauth2Server.ProtocolRouter` return tenant-specific values (`issuer`, `authorization_endpoint`, `token_endpoint`, `jwks_uri`) when a tenant is set, but sent them with `Cache-Control: public, max-age=3600` and no `Vary`. When the tenant is derived from something other than the URL (a header or the `Host`) and a shared cache sits in front, the cache key is the URL alone, so a stored response for one tenant is served to another for up to an hour. Affected clients may then send authorization codes and secrets to the wrong tenant\u0027s token endpoint and validate tokens against the wrong keys.\n\nThis issue affects ash_authentication_oauth2_server: from 0.1.3 before 0.3.1."
}
],
"value": "Use of Cache Containing Sensitive Information vulnerability in ash-project ash_authentication_oauth2_server allows a shared HTTP cache to serve one tenant\u0027s OAuth discovery metadata to another tenant\u0027s clients.\n\nThe RFC 8414 and RFC 9728 metadata endpoints in AshAuthentication.Phoenix.Oauth2Server.ProtocolRouter return tenant-specific values (issuer, authorization_endpoint, token_endpoint, jwks_uri) when a tenant is set, but sent them with Cache-Control: public, max-age=3600 and no Vary. When the tenant is derived from something other than the URL (a header or the Host) and a shared cache sits in front, the cache key is the URL alone, so a stored response for one tenant is served to another for up to an hour. Affected clients may then send authorization codes and secrets to the wrong tenant\u0027s token endpoint and validate tokens against the wrong keys.\n\nThis issue affects ash_authentication_oauth2_server: from 0.1.3 before 0.3.1."
}
],
"impacts": [
{
"capecId": "CAPEC-204",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-204 Lifting Sensitive Data Embedded in Cache"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-524",
"description": "CWE-524 Use of Cache Containing Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T22:28:24.500Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash_authentication_oauth2_server/security/advisories/GHSA-crqf-7m54-4hgc"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82755.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82755"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_authentication_oauth2_server/commit/768d87f70e4e97ae1d2bf1606b5bf3f4d03f24a1"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "ash_authentication_oauth2_server serves tenant-specific OAuth metadata as publicly cacheable without Vary, enabling cross-tenant confusion"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82755",
"datePublished": "2026-09-07T22:28:24.500Z",
"dateReserved": "2026-08-31T01:00:10.817Z",
"dateUpdated": "2026-09-08T14:42:17.718Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119613 (GCVE-0-2026-119613)
Vulnerability from cvelistv5 – Published: 2026-11-09 13:03 – Updated: 2026-11-12 16:11
VLAI
EPSS
VEX
Title
AshAi sends unrecognized tool errors verbatim to MCP clients and the model, disclosing internal details
Summary
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_ai allows a caller of an AshAi tool to read internal error details, including module names and data values, by making a tool call fail.
AshAi.ToToolError gained an implementation for Ash.Error.Unknown.UnknownError that returns the error's error field as is, and AshAi.Tool.Errors.format/1 sends that text to MCP clients (tool calls and resource reads in AshAi.Mcp.Server) and to the model in AshAi.ToolLoop. Ash stores the full Exception.format/2 output of a raised exception, or inspect/1 of a bare {:error, term} return, in that field. A tool result that cannot be JSON-encoded raises a Protocol.UndefinedError whose text includes the inspected value, which can be a whole record with fields the tool never returns. None of these errors were logged. The fix logs them under an error id and returns only that id to the caller.
This issue affects ash_ai: from 1.5.0 before 1.5.1.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-12 16:10 UTC
CWE
- CWE-209 - Generation of Error Message Containing Sensitive Information
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash_ai/security/ad… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-119613.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-119613 | related |
| https://github.com/ash-project/ash_ai/commit/fbad… | related |
| https://github.com/ash-project/ash_ai/commit/af79… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_ai |
Affected:
1.5.0 , < 1.5.1
(semver)
cpe:2.3:a:ash-project:ash_ai:*:*:*:*:*:*:*:* |
|
| ash-project | ash_ai |
Affected:
fbad04e9620ef70603f4e67e03f15092f58578f6 , < af7987769d78ed070c8a9f6e6ee542d91744eae6
(git)
cpe:2.3:a:ash-project:ash_ai:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119613",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-12T16:10:54.442769Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T16:11:19.623Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ash-project/ash_ai/security/advisories/GHSA-vhmw-fwrr-r6c6"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_ai:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAi.ToToolError.Ash.Error.Unknown.UnknownError\u0027",
"\u0027Elixir.AshAi.Tool.Errors\u0027",
"\u0027Elixir.AshAi.Mcp.Router\u0027",
"\u0027Elixir.AshAi.ToolLoop\u0027"
],
"packageName": "ash_ai",
"packageURL": "pkg:hex/ash_ai",
"product": "ash_ai",
"programFiles": [
"lib/ash_ai/to_tool_error.ex",
"lib/ash_ai/tool/errors.ex",
"lib/ash_ai/mcp/router.ex",
"lib/ash_ai/tool_loop.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAi.ToToolError.Ash.Error.Unknown.UnknownError\u0027:to_tool_error/1"
},
{
"name": "\u0027Elixir.AshAi.Tool.Errors\u0027:format/1"
},
{
"name": "\u0027Elixir.AshAi.Mcp.Router\u0027:call/2"
},
{
"name": "\u0027Elixir.AshAi.ToolLoop\u0027:run/2"
}
],
"repo": "https://github.com/ash-project/ash_ai",
"vendor": "ash-project",
"versions": [
{
"lessThan": "1.5.1",
"status": "affected",
"version": "1.5.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_ai:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAi.ToToolError.Ash.Error.Unknown.UnknownError\u0027",
"\u0027Elixir.AshAi.Tool.Errors\u0027",
"\u0027Elixir.AshAi.Mcp.Router\u0027",
"\u0027Elixir.AshAi.ToolLoop\u0027"
],
"packageName": "ash-project/ash_ai",
"packageURL": "pkg:github/ash-project/ash_ai",
"product": "ash_ai",
"programFiles": [
"lib/ash_ai/to_tool_error.ex",
"lib/ash_ai/tool/errors.ex",
"lib/ash_ai/mcp/router.ex",
"lib/ash_ai/tool_loop.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAi.ToToolError.Ash.Error.Unknown.UnknownError\u0027:to_tool_error/1"
},
{
"name": "\u0027Elixir.AshAi.Tool.Errors\u0027:format/1"
},
{
"name": "\u0027Elixir.AshAi.Mcp.Router\u0027:call/2"
},
{
"name": "\u0027Elixir.AshAi.ToolLoop\u0027:run/2"
}
],
"repo": "https://github.com/ash-project/ash_ai",
"vendor": "ash-project",
"versions": [
{
"lessThan": "af7987769d78ed070c8a9f6e6ee542d91744eae6",
"status": "affected",
"version": "fbad04e9620ef70603f4e67e03f15092f58578f6",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_ai:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.5.1",
"versionStartIncluding": "1.5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Sebastian Seilund"
},
{
"lang": "en",
"type": "reporter",
"value": "Sebastian Seilund"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"dateAssigned": "2026-11-07T21:44:36.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eGeneration of Error Message Containing Sensitive Information vulnerability in ash-project ash_ai allows a caller of an AshAi tool to read internal error details, including module names and data values, by making a tool call fail.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eAshAi.ToToolError\u003c/code\u003e gained an implementation for \u003ccode\u003eAsh.Error.Unknown.UnknownError\u003c/code\u003e that returns the error\u0027s \u003ccode\u003eerror\u003c/code\u003e field as is, and \u003ccode\u003eAshAi.Tool.Errors.format/1\u003c/code\u003e sends that text to MCP clients (tool calls and resource reads in \u003ccode\u003eAshAi.Mcp.Server\u003c/code\u003e) and to the model in \u003ccode\u003eAshAi.ToolLoop\u003c/code\u003e. Ash stores the full \u003ccode\u003eException.format/2\u003c/code\u003e output of a raised exception, or \u003ccode\u003einspect/1\u003c/code\u003e of a bare \u003ccode\u003e{:error, term}\u003c/code\u003e return, in that field. A tool result that cannot be JSON-encoded raises a \u003ccode\u003eProtocol.UndefinedError\u003c/code\u003e whose text includes the inspected value, which can be a whole record with fields the tool never returns. None of these errors were logged. The fix logs them under an error id and returns only that id to the caller.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_ai: from 1.5.0 before 1.5.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_ai allows a caller of an AshAi tool to read internal error details, including module names and data values, by making a tool call fail.\n\n`AshAi.ToToolError` gained an implementation for `Ash.Error.Unknown.UnknownError` that returns the error\u0027s `error` field as is, and `AshAi.Tool.Errors.format/1` sends that text to MCP clients (tool calls and resource reads in `AshAi.Mcp.Server`) and to the model in `AshAi.ToolLoop`. Ash stores the full `Exception.format/2` output of a raised exception, or `inspect/1` of a bare `{:error, term}` return, in that field. A tool result that cannot be JSON-encoded raises a `Protocol.UndefinedError` whose text includes the inspected value, which can be a whole record with fields the tool never returns. None of these errors were logged. The fix logs them under an error id and returns only that id to the caller.\n\nThis issue affects ash_ai: from 1.5.0 before 1.5.1."
}
],
"value": "Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_ai allows a caller of an AshAi tool to read internal error details, including module names and data values, by making a tool call fail.\n\nAshAi.ToToolError gained an implementation for Ash.Error.Unknown.UnknownError that returns the error\u0027s error field as is, and AshAi.Tool.Errors.format/1 sends that text to MCP clients (tool calls and resource reads in AshAi.Mcp.Server) and to the model in AshAi.ToolLoop. Ash stores the full Exception.format/2 output of a raised exception, or inspect/1 of a bare {:error, term} return, in that field. A tool result that cannot be JSON-encoded raises a Protocol.UndefinedError whose text includes the inspected value, which can be a whole record with fields the tool never returns. None of these errors were logged. The fix logs them under an error id and returns only that id to the caller.\n\nThis issue affects ash_ai: from 1.5.0 before 1.5.1."
}
],
"impacts": [
{
"capecId": "CAPEC-215",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA caller with tool access sends unexpected or malformed tool arguments until a tool fails, then reads the returned error text to learn internal module and function names and the values the code failed on.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "A caller with tool access sends unexpected or malformed tool arguments until a tool fails, then reads the returned error text to learn internal module and function names and the values the code failed on."
}
],
"value": "A caller with tool access sends unexpected or malformed tool arguments until a tool fails, then reads the returned error text to learn internal module and function names and the values the code failed on."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-209",
"description": "CWE-209 Generation of Error Message Containing Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T13:03:21.386Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "Information disclosure in `AshAi.ToToolError` in AshAi sends raw exception text to tool callers",
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash_ai/security/advisories/GHSA-vhmw-fwrr-r6c6"
},
{
"name": "EEF CNA record for CVE-2026-119613",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-119613.html"
},
{
"name": "OSV record EEF-CVE-2026-119613",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-119613"
},
{
"name": "Introducing commit fbad04e in ash-project/ash_ai",
"tags": [
"related"
],
"url": "https://github.com/ash-project/ash_ai/commit/fbad04e9620ef70603f4e67e03f15092f58578f6"
},
{
"name": "Fix commit af79877 in ash-project/ash_ai",
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_ai/commit/af7987769d78ed070c8a9f6e6ee542d91744eae6"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "AshAi sends unrecognized tool errors verbatim to MCP clients and the model, disclosing internal details"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-119613",
"datePublished": "2026-11-09T13:03:21.386Z",
"dateReserved": "2026-10-30T23:45:01.997Z",
"dateUpdated": "2026-11-12T16:11:19.623Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-96581 (GCVE-0-2026-96581)
Vulnerability from cvelistv5 – Published: 2026-10-26 07:20 – Updated: 2026-10-26 14:35
VLAI
EPSS
VEX
Title
An upsert on the primary key in Ash ignores attribute multitenancy, so one tenant can read, overwrite and take over another tenant's records
Summary
Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash allows a user of one tenant to read, overwrite and take over another tenant's records via an upserting create action.
Under attribute multitenancy, Ash.Actions.Create (lib/ash/actions/create/create.ex) and Ash.Actions.Create.Bulk (lib/ash/actions/create/bulk.ex) upserted on the primary key, or on an all_tenants? identity, without scoping the conflicting record to the request's tenant. A caller of a create action with upsert? true that accepts the primary key, supplying a record id from another tenant, updated that record's upsert fields and received all of its attributes in the result. With the default upsert fields the tenant attribute was written too, moving the record into the caller's tenant. Read and update policies do not run for upserts, and tenant-scoped create policies pass because the tenant is the caller's own.
This issue affects ash: from 1.22.0 before 3.37.2.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-26 14:25 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash/security/advis… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-96581.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-96581 | related |
| https://github.com/ash-project/ash/commit/2333d01… | related |
| https://github.com/ash-project/ash/commit/c9f0cdb… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash |
Affected:
1.22.0 , < 3.37.2
(semver)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
|
| ash-project | ash |
Affected:
2333d01ddf37e5909769a513059b27e3183331c5 , < c9f0cdb31e7c084def05f3f5be69dd7bb7721754
(git)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-96581",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-26T14:25:41.244972Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T14:35:19.745Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Actions.Create\u0027",
"\u0027Elixir.Ash.Actions.Create.Bulk\u0027",
"\u0027Elixir.Ash.DataLayer.Ets\u0027",
"\u0027Elixir.Ash.DataLayer.Mnesia\u0027"
],
"packageName": "ash",
"packageURL": "pkg:hex/ash",
"product": "ash",
"programFiles": [
"lib/ash/actions/create/create.ex",
"lib/ash/actions/create/bulk.ex",
"lib/ash/data_layer/ets/ets.ex",
"lib/ash/data_layer/mnesia/mnesia.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Actions.Create\u0027:run/4"
},
{
"name": "\u0027Elixir.Ash.Actions.Create.Bulk\u0027:run/5"
},
{
"name": "\u0027Elixir.Ash.DataLayer.Ets\u0027:upsert/4"
},
{
"name": "\u0027Elixir.Ash.DataLayer.Mnesia\u0027:upsert/4"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "3.37.2",
"status": "affected",
"version": "1.22.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Actions.Create\u0027",
"\u0027Elixir.Ash.Actions.Create.Bulk\u0027",
"\u0027Elixir.Ash.DataLayer.Ets\u0027",
"\u0027Elixir.Ash.DataLayer.Mnesia\u0027"
],
"packageName": "ash-project/ash",
"packageURL": "pkg:github/ash-project/ash",
"product": "ash",
"programFiles": [
"lib/ash/actions/create/create.ex",
"lib/ash/actions/create/bulk.ex",
"lib/ash/data_layer/ets/ets.ex",
"lib/ash/data_layer/mnesia/mnesia.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Actions.Create\u0027:run/4"
},
{
"name": "\u0027Elixir.Ash.Actions.Create.Bulk\u0027:run/5"
},
{
"name": "\u0027Elixir.Ash.DataLayer.Ets\u0027:upsert/4"
},
{
"name": "\u0027Elixir.Ash.DataLayer.Mnesia\u0027:upsert/4"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "c9f0cdb31e7c084def05f3f5be69dd7bb7721754",
"status": "affected",
"version": "2333d01ddf37e5909769a513059b27e3183331c5",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eReachable when a resource uses attribute multitenancy and exposes to callers of one tenant a create action with \u003ccode\u003eupsert? true\u003c/code\u003e that either upserts on the primary key (no \u003ccode\u003eupsert_identity\u003c/code\u003e) and accepts it, or upserts on an \u003ccode\u003eall_tenants?\u003c/code\u003e identity, and the caller knows or can enumerate a key belonging to another tenant (for example a serial integer id, or an id from a shared link or export).\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Reachable when a resource uses attribute multitenancy and exposes to callers of one tenant a create action with `upsert? true` that either upserts on the primary key (no `upsert_identity`) and accepts it, or upserts on an `all_tenants?` identity, and the caller knows or can enumerate a key belonging to another tenant (for example a serial integer id, or an id from a shared link or export)."
}
],
"value": "Reachable when a resource uses attribute multitenancy and exposes to callers of one tenant a create action with upsert? true that either upserts on the primary key (no upsert_identity) and accepts it, or upserts on an all_tenants? identity, and the caller knows or can enumerate a key belonging to another tenant (for example a serial integer id, or an id from a shared link or export)."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.37.2",
"versionStartIncluding": "1.22.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Will Townsend"
},
{
"lang": "en",
"type": "reporter",
"value": "Will Townsend"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
}
],
"dateAssigned": "2026-10-26T05:14:04.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAuthorization Bypass Through User-Controlled Key vulnerability in ash-project ash allows a user of one tenant to read, overwrite and take over another tenant\u0027s records via an upserting create action.\u003c/p\u003e\n\u003cp\u003eUnder attribute multitenancy, \u003ccode\u003eAsh.Actions.Create\u003c/code\u003e (\u003ccode\u003elib/ash/actions/create/create.ex\u003c/code\u003e) and \u003ccode\u003eAsh.Actions.Create.Bulk\u003c/code\u003e (\u003ccode\u003elib/ash/actions/create/bulk.ex\u003c/code\u003e) upserted on the primary key, or on an \u003ccode\u003eall_tenants?\u003c/code\u003e identity, without scoping the conflicting record to the request\u0027s tenant. A caller of a create action with \u003ccode\u003eupsert? true\u003c/code\u003e that accepts the primary key, supplying a record id from another tenant, updated that record\u0027s upsert fields and received all of its attributes in the result. With the default upsert fields the tenant attribute was written too, moving the record into the caller\u0027s tenant. Read and update policies do not run for upserts, and tenant-scoped create policies pass because the tenant is the caller\u0027s own.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash: from 1.22.0 before 3.37.2.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash allows a user of one tenant to read, overwrite and take over another tenant\u0027s records via an upserting create action.\n\nUnder attribute multitenancy, `Ash.Actions.Create` (`lib/ash/actions/create/create.ex`) and `Ash.Actions.Create.Bulk` (`lib/ash/actions/create/bulk.ex`) upserted on the primary key, or on an `all_tenants?` identity, without scoping the conflicting record to the request\u0027s tenant. A caller of a create action with `upsert? true` that accepts the primary key, supplying a record id from another tenant, updated that record\u0027s upsert fields and received all of its attributes in the result. With the default upsert fields the tenant attribute was written too, moving the record into the caller\u0027s tenant. Read and update policies do not run for upserts, and tenant-scoped create policies pass because the tenant is the caller\u0027s own.\n\nThis issue affects ash: from 1.22.0 before 3.37.2."
}
],
"value": "Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash allows a user of one tenant to read, overwrite and take over another tenant\u0027s records via an upserting create action.\n\nUnder attribute multitenancy, Ash.Actions.Create (lib/ash/actions/create/create.ex) and Ash.Actions.Create.Bulk (lib/ash/actions/create/bulk.ex) upserted on the primary key, or on an all_tenants? identity, without scoping the conflicting record to the request\u0027s tenant. A caller of a create action with upsert? true that accepts the primary key, supplying a record id from another tenant, updated that record\u0027s upsert fields and received all of its attributes in the result. With the default upsert fields the tenant attribute was written too, moving the record into the caller\u0027s tenant. Read and update policies do not run for upserts, and tenant-scoped create policies pass because the tenant is the caller\u0027s own.\n\nThis issue affects ash: from 1.22.0 before 3.37.2."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA signed-in user of one tenant posts another tenant\u0027s record id to an upserting create action, receives that record\u0027s attributes, overwrites its upsert fields, and with the default upsert fields moves it into their own tenant.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "A signed-in user of one tenant posts another tenant\u0027s record id to an upserting create action, receives that record\u0027s attributes, overwrites its upsert fields, and with the default upsert fields moves it into their own tenant."
}
],
"value": "A signed-in user of one tenant posts another tenant\u0027s record id to an upserting create action, receives that record\u0027s attributes, overwrites its upsert fields, and with the default upsert fields moves it into their own tenant."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T07:20:07.186Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "An upsert on the primary key in Ash ignores attribute multitenancy, so one tenant can read, overwrite and take over another tenant\u0027s records",
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-vw7c-67pf-gh96"
},
{
"name": "EEF CNA record for CVE-2026-96581",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-96581.html"
},
{
"name": "OSV record EEF-CVE-2026-96581",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-96581"
},
{
"name": "Introducing commit 2333d01 in ash-project/ash",
"tags": [
"related"
],
"url": "https://github.com/ash-project/ash/commit/2333d01ddf37e5909769a513059b27e3183331c5"
},
{
"name": "Fix commit c9f0cdb in ash-project/ash",
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash/commit/c9f0cdb31e7c084def05f3f5be69dd7bb7721754"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "An upsert on the primary key in Ash ignores attribute multitenancy, so one tenant can read, overwrite and take over another tenant\u0027s records",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAdd \u003ccode\u003eupsert_condition expr(\u0026lt;tenant attribute\u0026gt; == ^tenant())\u003c/code\u003e to every create action that upserts on the primary key or on an \u003ccode\u003eall_tenants?\u003c/code\u003e identity, and do not combine it with \u003ccode\u003ereturn_skipped_upsert?\u003c/code\u003e. An upsert into another tenant\u0027s record then fails with \u003ccode\u003eAsh.Error.Changes.StaleRecord\u003c/code\u003e (or is skipped in a bulk create) and leaves that record unchanged. This does not help on the Mnesia data layer, which ignores upsert conditions in affected versions.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Add `upsert_condition expr(\u003ctenant attribute\u003e == ^tenant())` to every create action that upserts on the primary key or on an `all_tenants?` identity, and do not combine it with `return_skipped_upsert?`. An upsert into another tenant\u0027s record then fails with `Ash.Error.Changes.StaleRecord` (or is skipped in a bulk create) and leaves that record unchanged. This does not help on the Mnesia data layer, which ignores upsert conditions in affected versions."
}
],
"value": "Add upsert_condition expr(\u003ctenant attribute\u003e == ^tenant()) to every create action that upserts on the primary key or on an all_tenants? identity, and do not combine it with return_skipped_upsert?. An upsert into another tenant\u0027s record then fails with Ash.Error.Changes.StaleRecord (or is skipped in a bulk create) and leaves that record unchanged. This does not help on the Mnesia data layer, which ignores upsert conditions in affected versions."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-96581",
"datePublished": "2026-10-26T07:20:07.186Z",
"dateReserved": "2026-10-25T17:30:02.206Z",
"dateUpdated": "2026-10-26T14:35:19.745Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-115627 (GCVE-0-2026-115627)
Vulnerability from cvelistv5 – Published: 2026-10-25 19:49 – Updated: 2026-10-26 14:35
VLAI
EPSS
VEX
Title
AshPostgres ignores attribute multitenancy on the join resource when loading many_to_many and through relationships, returning records related through other tenants' rows
Summary
Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to load destination records linked to a source record only through another tenant's join rows.
When a many_to_many relationship, or a through relationship, is loaded with a lateral join (for example with a per-record limit or sort), AshPostgres.DataLayer builds the query for the join resource, and for each resource along a through path, in lateral_join_query/3 and through_step_queries/4 without running that resource's read action, which is where attribute multitenancy is applied. When those resources use strategy :attribute multitenancy, rows belonging to other tenants were joined, so the load returned destination records that the caller's tenant is not related to.
This issue affects ash_postgres: from 0.38.0 before 2.15.2.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-26 14:27 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash/security/advis… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-115627.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-115627 | related |
| https://github.com/ash-project/ash_postgres/commi… | related |
| https://github.com/ash-project/ash_postgres/commi… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_postgres |
Affected:
0.38.0 , < 2.15.2
(semver)
cpe:2.3:a:ash-project:ash_postgres:*:*:*:*:*:*:*:* |
|
| ash-project | ash_postgres |
Affected:
7115bec58678f13b1ac2fb4822a0ba1aea9dbec5 , < 8c25c945c39a45299193fe70b09fc2fa2aacac7b
(git)
cpe:2.3:a:ash-project:ash_postgres:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-115627",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-26T14:27:42.624297Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T14:35:21.109Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_postgres:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshPostgres.DataLayer\u0027"
],
"packageName": "ash_postgres",
"packageURL": "pkg:hex/ash_postgres",
"product": "ash_postgres",
"programFiles": [
"lib/data_layer.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshPostgres.DataLayer\u0027:lateral_join_query/3"
},
{
"name": "\u0027Elixir.AshPostgres.DataLayer\u0027:through_step_queries/4"
},
{
"name": "\u0027Elixir.AshPostgres.DataLayer\u0027:run_query_with_lateral_join/4"
}
],
"repo": "https://github.com/ash-project/ash_postgres",
"vendor": "ash-project",
"versions": [
{
"lessThan": "2.15.2",
"status": "affected",
"version": "0.38.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_postgres:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshPostgres.DataLayer\u0027"
],
"packageName": "ash-project/ash_postgres",
"packageURL": "pkg:github/ash-project/ash_postgres",
"product": "ash_postgres",
"programFiles": [
"lib/data_layer.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshPostgres.DataLayer\u0027:lateral_join_query/3"
},
{
"name": "\u0027Elixir.AshPostgres.DataLayer\u0027:through_step_queries/4"
},
{
"name": "\u0027Elixir.AshPostgres.DataLayer\u0027:run_query_with_lateral_join/4"
}
],
"repo": "https://github.com/ash-project/ash_postgres",
"vendor": "ash-project",
"versions": [
{
"lessThan": "8c25c945c39a45299193fe70b09fc2fa2aacac7b",
"status": "affected",
"version": "7115bec58678f13b1ac2fb4822a0ba1aea9dbec5",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eReachable when the join resource of a \u003ccode\u003emany_to_many\u003c/code\u003e relationship, or a resource along a \u003ccode\u003ethrough\u003c/code\u003e path, uses attribute multitenancy and holds rows from several tenants, and the relationship is loaded with a lateral join (for example with a limit, offset or sort on the relationship).\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Reachable when the join resource of a `many_to_many` relationship, or a resource along a `through` path, uses attribute multitenancy and holds rows from several tenants, and the relationship is loaded with a lateral join (for example with a limit, offset or sort on the relationship)."
}
],
"value": "Reachable when the join resource of a many_to_many relationship, or a resource along a through path, uses attribute multitenancy and holds rows from several tenants, and the relationship is loaded with a lateral join (for example with a limit, offset or sort on the relationship)."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_postgres:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.15.2",
"versionStartIncluding": "0.38.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Will Townsend"
},
{
"lang": "en",
"type": "reporter",
"value": "Will Townsend"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
}
],
"dateAssigned": "2026-10-25T17:27:14.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIncorrect Authorization vulnerability in ash-project ash_postgres allows a user to load destination records linked to a source record only through another tenant\u0027s join rows.\u003c/p\u003e\n\u003cp\u003eWhen a \u003ccode\u003emany_to_many\u003c/code\u003e relationship, or a \u003ccode\u003ethrough\u003c/code\u003e relationship, is loaded with a lateral join (for example with a per-record limit or sort), \u003ccode\u003eAshPostgres.DataLayer\u003c/code\u003e builds the query for the join resource, and for each resource along a \u003ccode\u003ethrough\u003c/code\u003e path, in \u003ccode\u003elateral_join_query/3\u003c/code\u003e and \u003ccode\u003ethrough_step_queries/4\u003c/code\u003e without running that resource\u0027s read action, which is where attribute multitenancy is applied. When those resources use \u003ccode\u003estrategy :attribute\u003c/code\u003e multitenancy, rows belonging to other tenants were joined, so the load returned destination records that the caller\u0027s tenant is not related to.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_postgres: from 0.38.0 before 2.15.2.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to load destination records linked to a source record only through another tenant\u0027s join rows.\n\nWhen a `many_to_many` relationship, or a `through` relationship, is loaded with a lateral join (for example with a per-record limit or sort), `AshPostgres.DataLayer` builds the query for the join resource, and for each resource along a `through` path, in `lateral_join_query/3` and `through_step_queries/4` without running that resource\u0027s read action, which is where attribute multitenancy is applied. When those resources use `strategy :attribute` multitenancy, rows belonging to other tenants were joined, so the load returned destination records that the caller\u0027s tenant is not related to.\n\nThis issue affects ash_postgres: from 0.38.0 before 2.15.2."
}
],
"value": "Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to load destination records linked to a source record only through another tenant\u0027s join rows.\n\nWhen a many_to_many relationship, or a through relationship, is loaded with a lateral join (for example with a per-record limit or sort), AshPostgres.DataLayer builds the query for the join resource, and for each resource along a through path, in lateral_join_query/3 and through_step_queries/4 without running that resource\u0027s read action, which is where attribute multitenancy is applied. When those resources use strategy :attribute multitenancy, rows belonging to other tenants were joined, so the load returned destination records that the caller\u0027s tenant is not related to.\n\nThis issue affects ash_postgres: from 0.38.0 before 2.15.2."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA user of one tenant loading a many_to_many or through relationship receives destination records linked only through another tenant\u0027s join rows.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "A user of one tenant loading a many_to_many or through relationship receives destination records linked only through another tenant\u0027s join rows."
}
],
"value": "A user of one tenant loading a many_to_many or through relationship receives destination records linked only through another tenant\u0027s join rows."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-25T19:49:50.510Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "AshPostgres ignores attribute multitenancy on the join resource when loading `many_to_many` and `through` relationships, returning records related through other tenants\u0027 rows",
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-gr2r-f49c-9gm2"
},
{
"name": "EEF CNA record for CVE-2026-115627",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-115627.html"
},
{
"name": "OSV record EEF-CVE-2026-115627",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-115627"
},
{
"name": "Introducing commit 7115bec in ash-project/ash_postgres",
"tags": [
"related"
],
"url": "https://github.com/ash-project/ash_postgres/commit/7115bec58678f13b1ac2fb4822a0ba1aea9dbec5"
},
{
"name": "Fix commit 8c25c94 in ash-project/ash_postgres",
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_postgres/commit/8c25c945c39a45299193fe70b09fc2fa2aacac7b"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "AshPostgres ignores attribute multitenancy on the join resource when loading many_to_many and through relationships, returning records related through other tenants\u0027 rows"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-115627",
"datePublished": "2026-10-25T19:49:50.510Z",
"dateReserved": "2026-10-23T13:00:02.154Z",
"dateUpdated": "2026-10-26T14:35:21.109Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-115635 (GCVE-0-2026-115635)
Vulnerability from cvelistv5 – Published: 2026-10-25 19:48 – Updated: 2026-10-26 14:35
VLAI
EPSS
VEX
Title
AshPostgres returns another tenant's record for a skipped upsert when return_skipped_upsert? is set
Summary
Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to read another tenant's record through a skipped upsert.
When Ash.bulk_create/4 or a single create runs as an upsert with return_skipped_upsert?: true and the upsert is skipped (for example because its upsert_condition does not hold), AshPostgres.DataLayer reads the existing row back by the upsert identity in do_bulk_create/3 and upsert/4. That lookup did not apply the resource's attribute multitenancy, so on a resource using strategy :attribute it could match and return the row of another tenant with the same identity values, exposing its fields to the caller.
This issue affects ash_postgres: from 2.6.22 before 2.15.2.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-26 14:29 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash/security/advis… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-115635.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-115635 | related |
| https://github.com/ash-project/ash_postgres/commi… | related |
| https://github.com/ash-project/ash_postgres/commi… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_postgres |
Affected:
2.6.22 , < 2.15.2
(semver)
cpe:2.3:a:ash-project:ash_postgres:*:*:*:*:*:*:*:* |
|
| ash-project | ash_postgres |
Affected:
af0903f1380468bbe1b61fe65acb33772b5e24a5 , < 8aa81220c401cae412d21078d11b3519ea25d3a9
(git)
cpe:2.3:a:ash-project:ash_postgres:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-115635",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-26T14:29:19.217057Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T14:35:21.261Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_postgres:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshPostgres.DataLayer\u0027"
],
"packageName": "ash_postgres",
"packageURL": "pkg:hex/ash_postgres",
"product": "ash_postgres",
"programFiles": [
"lib/data_layer.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshPostgres.DataLayer\u0027:do_bulk_create/3"
},
{
"name": "\u0027Elixir.AshPostgres.DataLayer\u0027:upsert/4"
},
{
"name": "\u0027Elixir.AshPostgres.DataLayer\u0027:bulk_create/3"
}
],
"repo": "https://github.com/ash-project/ash_postgres",
"vendor": "ash-project",
"versions": [
{
"lessThan": "2.15.2",
"status": "affected",
"version": "2.6.22",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_postgres:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshPostgres.DataLayer\u0027"
],
"packageName": "ash-project/ash_postgres",
"packageURL": "pkg:github/ash-project/ash_postgres",
"product": "ash_postgres",
"programFiles": [
"lib/data_layer.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshPostgres.DataLayer\u0027:do_bulk_create/3"
},
{
"name": "\u0027Elixir.AshPostgres.DataLayer\u0027:upsert/4"
},
{
"name": "\u0027Elixir.AshPostgres.DataLayer\u0027:bulk_create/3"
}
],
"repo": "https://github.com/ash-project/ash_postgres",
"vendor": "ash-project",
"versions": [
{
"lessThan": "8aa81220c401cae412d21078d11b3519ea25d3a9",
"status": "affected",
"version": "af0903f1380468bbe1b61fe65acb33772b5e24a5",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eReachable when a resource uses attribute multitenancy, an action performs upserts with \u003ccode\u003ereturn_skipped_upsert?: true\u003c/code\u003e, and a caller can supply identity values that another tenant also uses.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Reachable when a resource uses attribute multitenancy, an action performs upserts with `return_skipped_upsert?: true`, and a caller can supply identity values that another tenant also uses."
}
],
"value": "Reachable when a resource uses attribute multitenancy, an action performs upserts with return_skipped_upsert?: true, and a caller can supply identity values that another tenant also uses."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_postgres:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.15.2",
"versionStartIncluding": "2.6.22",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Will Townsend"
},
{
"lang": "en",
"type": "reporter",
"value": "Will Townsend"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
}
],
"dateAssigned": "2026-10-25T17:27:42.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIncorrect Authorization vulnerability in ash-project ash_postgres allows a user to read another tenant\u0027s record through a skipped upsert.\u003c/p\u003e\n\u003cp\u003eWhen \u003ccode\u003eAsh.bulk_create/4\u003c/code\u003e or a single create runs as an upsert with \u003ccode\u003ereturn_skipped_upsert?: true\u003c/code\u003e and the upsert is skipped (for example because its \u003ccode\u003eupsert_condition\u003c/code\u003e does not hold), \u003ccode\u003eAshPostgres.DataLayer\u003c/code\u003e reads the existing row back by the upsert identity in \u003ccode\u003edo_bulk_create/3\u003c/code\u003e and \u003ccode\u003eupsert/4\u003c/code\u003e. That lookup did not apply the resource\u0027s attribute multitenancy, so on a resource using \u003ccode\u003estrategy :attribute\u003c/code\u003e it could match and return the row of another tenant with the same identity values, exposing its fields to the caller.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_postgres: from 2.6.22 before 2.15.2.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to read another tenant\u0027s record through a skipped upsert.\n\nWhen `Ash.bulk_create/4` or a single create runs as an upsert with `return_skipped_upsert?: true` and the upsert is skipped (for example because its `upsert_condition` does not hold), `AshPostgres.DataLayer` reads the existing row back by the upsert identity in `do_bulk_create/3` and `upsert/4`. That lookup did not apply the resource\u0027s attribute multitenancy, so on a resource using `strategy :attribute` it could match and return the row of another tenant with the same identity values, exposing its fields to the caller.\n\nThis issue affects ash_postgres: from 2.6.22 before 2.15.2."
}
],
"value": "Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to read another tenant\u0027s record through a skipped upsert.\n\nWhen Ash.bulk_create/4 or a single create runs as an upsert with return_skipped_upsert?: true and the upsert is skipped (for example because its upsert_condition does not hold), AshPostgres.DataLayer reads the existing row back by the upsert identity in do_bulk_create/3 and upsert/4. That lookup did not apply the resource\u0027s attribute multitenancy, so on a resource using strategy :attribute it could match and return the row of another tenant with the same identity values, exposing its fields to the caller.\n\nThis issue affects ash_postgres: from 2.6.22 before 2.15.2."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA user of one tenant whose upsert is skipped receives another tenant\u0027s record with the same identity values.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "A user of one tenant whose upsert is skipped receives another tenant\u0027s record with the same identity values."
}
],
"value": "A user of one tenant whose upsert is skipped receives another tenant\u0027s record with the same identity values."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-25T19:48:43.829Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "`Ash.bulk_create` with `return_skipped_upsert?: true` in AshPostgres returns another tenant\u0027s record for a skipped upsert",
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-36hg-wwp2-fg8w"
},
{
"name": "EEF CNA record for CVE-2026-115635",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-115635.html"
},
{
"name": "OSV record EEF-CVE-2026-115635",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-115635"
},
{
"name": "Introducing commit af0903f in ash-project/ash_postgres",
"tags": [
"related"
],
"url": "https://github.com/ash-project/ash_postgres/commit/af0903f1380468bbe1b61fe65acb33772b5e24a5"
},
{
"name": "Fix commit 8aa8122 in ash-project/ash_postgres",
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_postgres/commit/8aa81220c401cae412d21078d11b3519ea25d3a9"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "AshPostgres returns another tenant\u0027s record for a skipped upsert when return_skipped_upsert? is set"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-115635",
"datePublished": "2026-10-25T19:48:43.829Z",
"dateReserved": "2026-10-23T13:00:02.145Z",
"dateUpdated": "2026-10-26T14:35:21.261Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114214 (GCVE-0-2026-114214)
Vulnerability from cvelistv5 – Published: 2026-10-25 19:47 – Updated: 2026-10-26 14:35
VLAI
EPSS
VEX
Title
Loading a through relationship with a limit of 1 in Ash ignores the through path and returns unrelated destination records
Summary
Incorrect Authorization vulnerability in ash-project ash allows a client to read destination records unrelated to the source record through a through relationship.
When a has_many relationship declared with through: was loaded for a single record with a limit of 1, or an unsorted has_one through relationship was loaded with a limit of 1, lateral_join?/4 in lib/ash/actions/read/relationships.ex chose the path that reads the destination without any filter linking it to the source. The load returned the first destination record by sort, or any other record with an offset. The read still runs the destination's policies but carries the relationship as accessing_from, so a client paging such a field (for example teachers(limit: 1, offset: n) through AshGraphql) can enumerate destination records that policies allow only when reached through that relationship.
This issue affects ash: from 3.24.0 before 3.37.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-26 14:28 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash/security/advis… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-114214.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-114214 | related |
| https://github.com/ash-project/ash/commit/24f41e2… | related |
| https://github.com/ash-project/ash/commit/e374633… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash |
Affected:
3.24.0 , < 3.37.1
(semver)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
|
| ash-project | ash |
Affected:
24f41e23dcbd9d07cde270a8141490e8f79251f5 , < e37463307304b26bc8fd606322e5c4d8f7f060e5
(git)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-114214",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-26T14:28:34.411522Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T14:35:21.414Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Actions.Read.Relationships\u0027"
],
"packageName": "ash",
"packageURL": "pkg:hex/ash",
"product": "ash",
"programFiles": [
"lib/ash/actions/read/relationships.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Actions.Read.Relationships\u0027:lateral_join?/4"
},
{
"name": "\u0027Elixir.Ash.Actions.Read.Relationships\u0027:load/4"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "3.37.1",
"status": "affected",
"version": "3.24.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Actions.Read.Relationships\u0027"
],
"packageName": "ash-project/ash",
"packageURL": "pkg:github/ash-project/ash",
"product": "ash",
"programFiles": [
"lib/ash/actions/read/relationships.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Actions.Read.Relationships\u0027:lateral_join?/4"
},
{
"name": "\u0027Elixir.Ash.Actions.Read.Relationships\u0027:load/4"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "e37463307304b26bc8fd606322e5c4d8f7f060e5",
"status": "affected",
"version": "24f41e23dcbd9d07cde270a8141490e8f79251f5",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eReachable when a \u003ccode\u003ethrough\u003c/code\u003e relationship is loaded for a single record with a caller-controlled limit of 1 (and optionally an offset), for example through AshGraphql relationship field arguments, and the destination resource\u0027s read policies rely on the relationship (\u003ccode\u003eaccessing_from\u003c/code\u003e) or are otherwise open to the caller.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Reachable when a `through` relationship is loaded for a single record with a caller-controlled limit of 1 (and optionally an offset), for example through AshGraphql relationship field arguments, and the destination resource\u0027s read policies rely on the relationship (`accessing_from`) or are otherwise open to the caller."
}
],
"value": "Reachable when a through relationship is loaded for a single record with a caller-controlled limit of 1 (and optionally an offset), for example through AshGraphql relationship field arguments, and the destination resource\u0027s read policies rely on the relationship (accessing_from) or are otherwise open to the caller."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.37.1",
"versionStartIncluding": "3.24.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Will Townsend"
},
{
"lang": "en",
"type": "reporter",
"value": "Will Townsend"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
}
],
"dateAssigned": "2026-10-25T17:24:26.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIncorrect Authorization vulnerability in ash-project ash allows a client to read destination records unrelated to the source record through a \u003ccode\u003ethrough\u003c/code\u003e relationship.\u003c/p\u003e\n\u003cp\u003eWhen a \u003ccode\u003ehas_many\u003c/code\u003e relationship declared with \u003ccode\u003ethrough:\u003c/code\u003e was loaded for a single record with a limit of 1, or an unsorted \u003ccode\u003ehas_one\u003c/code\u003e \u003ccode\u003ethrough\u003c/code\u003e relationship was loaded with a limit of 1, \u003ccode\u003elateral_join?/4\u003c/code\u003e in \u003ccode\u003elib/ash/actions/read/relationships.ex\u003c/code\u003e chose the path that reads the destination without any filter linking it to the source. The load returned the first destination record by sort, or any other record with an \u003ccode\u003eoffset\u003c/code\u003e. The read still runs the destination\u0027s policies but carries the relationship as \u003ccode\u003eaccessing_from\u003c/code\u003e, so a client paging such a field (for example \u003ccode\u003eteachers(limit: 1, offset: n)\u003c/code\u003e through AshGraphql) can enumerate destination records that policies allow only when reached through that relationship.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash: from 3.24.0 before 3.37.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Incorrect Authorization vulnerability in ash-project ash allows a client to read destination records unrelated to the source record through a `through` relationship.\n\nWhen a `has_many` relationship declared with `through:` was loaded for a single record with a limit of 1, or an unsorted `has_one` `through` relationship was loaded with a limit of 1, `lateral_join?/4` in `lib/ash/actions/read/relationships.ex` chose the path that reads the destination without any filter linking it to the source. The load returned the first destination record by sort, or any other record with an `offset`. The read still runs the destination\u0027s policies but carries the relationship as `accessing_from`, so a client paging such a field (for example `teachers(limit: 1, offset: n)` through AshGraphql) can enumerate destination records that policies allow only when reached through that relationship.\n\nThis issue affects ash: from 3.24.0 before 3.37.1."
}
],
"value": "Incorrect Authorization vulnerability in ash-project ash allows a client to read destination records unrelated to the source record through a through relationship.\n\nWhen a has_many relationship declared with through: was loaded for a single record with a limit of 1, or an unsorted has_one through relationship was loaded with a limit of 1, lateral_join?/4 in lib/ash/actions/read/relationships.ex chose the path that reads the destination without any filter linking it to the source. The load returned the first destination record by sort, or any other record with an offset. The read still runs the destination\u0027s policies but carries the relationship as accessing_from, so a client paging such a field (for example teachers(limit: 1, offset: n) through AshGraphql) can enumerate destination records that policies allow only when reached through that relationship.\n\nThis issue affects ash: from 3.24.0 before 3.37.1."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA client paging a through relationship field with a limit of 1 reads destination records that should only be reachable through that relationship.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "A client paging a through relationship field with a limit of 1 reads destination records that should only be reachable through that relationship."
}
],
"value": "A client paging a through relationship field with a limit of 1 reads destination records that should only be reachable through that relationship."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-25T19:47:30.612Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "Loading a `through` relationship on a single record with `limit: 1` ignores the through path and returns arbitrary destination records",
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-g2h4-xp57-q863"
},
{
"name": "EEF CNA record for CVE-2026-114214",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-114214.html"
},
{
"name": "OSV record EEF-CVE-2026-114214",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-114214"
},
{
"name": "Introducing commit 24f41e2 in ash-project/ash",
"tags": [
"related"
],
"url": "https://github.com/ash-project/ash/commit/24f41e23dcbd9d07cde270a8141490e8f79251f5"
},
{
"name": "Fix commit e374633 in ash-project/ash",
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash/commit/e37463307304b26bc8fd606322e5c4d8f7f060e5"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Loading a through relationship with a limit of 1 in Ash ignores the through path and returns unrelated destination records"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-114214",
"datePublished": "2026-10-25T19:47:30.612Z",
"dateReserved": "2026-10-25T14:30:01.870Z",
"dateUpdated": "2026-10-26T14:35:21.414Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105283 (GCVE-0-2026-105283)
Vulnerability from cvelistv5 – Published: 2026-10-12 11:16 – Updated: 2026-10-16 16:53
VLAI
EPSS
VEX
Title
Internal error terms inspected into AshTypescript RPC error responses
Summary
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_typescript allows an unauthenticated attacker to read internal Elixir terms from an RPC error response by provoking an error the error builder has no dedicated clause for.
AshTypescript.Rpc.ErrorBuilder.build_error_response/1 in lib/ash_typescript/rpc/error_builder.ex renders a pipeline error term that matches no specific clause with inspect/1 and places the result in details.error of the client-facing error. Ash exceptions take a separate path in AshTypescript.Rpc.Errors where unhandled cases are redacted behind an errorId, but these fallbacks have no redaction, so whatever the term carries reaches the HTTP or channel response. Two request paths hand it such terms: a struct-typed action argument with an invalid nested value, where cast_map_to_struct/2 in lib/ash_typescript/rpc/input_formatter.ex throws the raw Ash.Type cast error into the builder, and field selection on a generic action that returns a primitive, where format_field_type/1 inspects the full Ash.Info.Manifest.Type struct into vars.returnType. Resource module names in vars.resource are not treated as sensitive and are out of scope.
This issue affects ash_typescript: from 0.1.0 before 0.19.1.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 16:50 UTC
CWE
- CWE-209 - Generation of Error Message Containing Sensitive Information
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash_typescript/sec… | relatedvendor-advisory |
| https://cna.erlef.org/cves/CVE-2026-105283.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-105283 | related |
| https://github.com/ash-project/ash_typescript/com… | related |
| https://github.com/ash-project/ash_typescript/com… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_typescript |
Affected:
0.1.0 , < 0.19.1
(semver)
cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:* |
|
| ash-project | ash_typescript |
Affected:
8e204ce34e24a158cf22a2dac4d53c44716c9e30 , < 4b3c65203ee78dc992d6d2e6559625c5460a01cd
(git)
cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105283",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T16:50:44.234803Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T16:53:18.072Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ash-project/ash_typescript/security/advisories/GHSA-7gxc-w225-f7f3"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshTypescript.Rpc.ErrorBuilder\u0027",
"\u0027Elixir.AshTypescript.Rpc.InputFormatter\u0027",
"\u0027Elixir.AshTypescript.Rpc\u0027"
],
"packageName": "ash_typescript",
"packageURL": "pkg:hex/ash_typescript",
"product": "ash_typescript",
"programFiles": [
"lib/ash_typescript/rpc/error_builder.ex",
"lib/ash_typescript/rpc/input_formatter.ex",
"lib/ash_typescript/rpc.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshTypescript.Rpc.ErrorBuilder\u0027:build_error_response/1"
},
{
"name": "\u0027Elixir.AshTypescript.Rpc.ErrorBuilder\u0027:format_field_type/1"
},
{
"name": "\u0027Elixir.AshTypescript.Rpc.InputFormatter\u0027:cast_map_to_struct/2"
},
{
"name": "\u0027Elixir.AshTypescript.Rpc\u0027:run_action/3"
},
{
"name": "\u0027Elixir.AshTypescript.Rpc\u0027:validate_action/3"
}
],
"repo": "https://github.com/ash-project/ash_typescript",
"vendor": "ash-project",
"versions": [
{
"lessThan": "0.19.1",
"status": "affected",
"version": "0.1.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshTypescript.Rpc.ErrorBuilder\u0027",
"\u0027Elixir.AshTypescript.Rpc.InputFormatter\u0027",
"\u0027Elixir.AshTypescript.Rpc\u0027"
],
"packageName": "ash-project/ash_typescript",
"packageURL": "pkg:github/ash-project/ash_typescript",
"product": "ash_typescript",
"programFiles": [
"lib/ash_typescript/rpc/error_builder.ex",
"lib/ash_typescript/rpc/input_formatter.ex",
"lib/ash_typescript/rpc.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshTypescript.Rpc.ErrorBuilder\u0027:build_error_response/1"
},
{
"name": "\u0027Elixir.AshTypescript.Rpc.ErrorBuilder\u0027:format_field_type/1"
},
{
"name": "\u0027Elixir.AshTypescript.Rpc.InputFormatter\u0027:cast_map_to_struct/2"
},
{
"name": "\u0027Elixir.AshTypescript.Rpc\u0027:run_action/3"
},
{
"name": "\u0027Elixir.AshTypescript.Rpc\u0027:validate_action/3"
}
],
"repo": "https://github.com/ash-project/ash_typescript",
"vendor": "ash-project",
"versions": [
{
"lessThan": "4b3c65203ee78dc992d6d2e6559625c5460a01cd",
"status": "affected",
"version": "8e204ce34e24a158cf22a2dac4d53c44716c9e30",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe application exposes an AshTypescript RPC endpoint over HTTP or a channel and has an action with a struct-typed argument, or a generic action with a primitive return type that accepts field selection.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "The application exposes an AshTypescript RPC endpoint over HTTP or a channel and has an action with a struct-typed argument, or a generic action with a primitive return type that accepts field selection."
}
],
"value": "The application exposes an AshTypescript RPC endpoint over HTTP or a channel and has an action with a struct-typed argument, or a generic action with a primitive return type that accepts field selection."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.19.1",
"versionStartIncluding": "0.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Shoukry / Udin"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Shoukry / Udin"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Torkild Gundersen Kjevik / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"dateAssigned": "2026-10-12T09:59:25.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eGeneration of Error Message Containing Sensitive Information vulnerability in ash-project ash_typescript allows an unauthenticated attacker to read internal Elixir terms from an RPC error response by provoking an error the error builder has no dedicated clause for.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eAshTypescript.Rpc.ErrorBuilder.build_error_response/1\u003c/code\u003e in \u003ccode\u003elib/ash_typescript/rpc/error_builder.ex\u003c/code\u003e renders a pipeline error term that matches no specific clause with \u003ccode\u003einspect/1\u003c/code\u003e and places the result in \u003ccode\u003edetails.error\u003c/code\u003e of the client-facing error. Ash exceptions take a separate path in \u003ccode\u003eAshTypescript.Rpc.Errors\u003c/code\u003e where unhandled cases are redacted behind an \u003ccode\u003eerrorId\u003c/code\u003e, but these fallbacks have no redaction, so whatever the term carries reaches the HTTP or channel response. Two request paths hand it such terms: a struct-typed action argument with an invalid nested value, where \u003ccode\u003ecast_map_to_struct/2\u003c/code\u003e in \u003ccode\u003elib/ash_typescript/rpc/input_formatter.ex\u003c/code\u003e throws the raw \u003ccode\u003eAsh.Type\u003c/code\u003e cast error into the builder, and field selection on a generic action that returns a primitive, where \u003ccode\u003eformat_field_type/1\u003c/code\u003e inspects the full \u003ccode\u003eAsh.Info.Manifest.Type\u003c/code\u003e struct into \u003ccode\u003evars.returnType\u003c/code\u003e. Resource module names in \u003ccode\u003evars.resource\u003c/code\u003e are not treated as sensitive and are out of scope.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_typescript: from 0.1.0 before 0.19.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_typescript allows an unauthenticated attacker to read internal Elixir terms from an RPC error response by provoking an error the error builder has no dedicated clause for.\n\n`AshTypescript.Rpc.ErrorBuilder.build_error_response/1` in `lib/ash_typescript/rpc/error_builder.ex` renders a pipeline error term that matches no specific clause with `inspect/1` and places the result in `details.error` of the client-facing error. Ash exceptions take a separate path in `AshTypescript.Rpc.Errors` where unhandled cases are redacted behind an `errorId`, but these fallbacks have no redaction, so whatever the term carries reaches the HTTP or channel response. Two request paths hand it such terms: a struct-typed action argument with an invalid nested value, where `cast_map_to_struct/2` in `lib/ash_typescript/rpc/input_formatter.ex` throws the raw `Ash.Type` cast error into the builder, and field selection on a generic action that returns a primitive, where `format_field_type/1` inspects the full `Ash.Info.Manifest.Type` struct into `vars.returnType`. Resource module names in `vars.resource` are not treated as sensitive and are out of scope.\n\nThis issue affects ash_typescript: from 0.1.0 before 0.19.1."
}
],
"value": "Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_typescript allows an unauthenticated attacker to read internal Elixir terms from an RPC error response by provoking an error the error builder has no dedicated clause for.\n\nAshTypescript.Rpc.ErrorBuilder.build_error_response/1 in lib/ash_typescript/rpc/error_builder.ex renders a pipeline error term that matches no specific clause with inspect/1 and places the result in details.error of the client-facing error. Ash exceptions take a separate path in AshTypescript.Rpc.Errors where unhandled cases are redacted behind an errorId, but these fallbacks have no redaction, so whatever the term carries reaches the HTTP or channel response. Two request paths hand it such terms: a struct-typed action argument with an invalid nested value, where cast_map_to_struct/2 in lib/ash_typescript/rpc/input_formatter.ex throws the raw Ash.Type cast error into the builder, and field selection on a generic action that returns a primitive, where format_field_type/1 inspects the full Ash.Info.Manifest.Type struct into vars.returnType. Resource module names in vars.resource are not treated as sensitive and are out of scope.\n\nThis issue affects ash_typescript: from 0.1.0 before 0.19.1."
}
],
"impacts": [
{
"capecId": "CAPEC-54",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAny client able to call the RPC endpoint can submit malformed struct arguments or field selections and read internal Elixir terms, including any state the failing pipeline step carried, from the error response.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Any client able to call the RPC endpoint can submit malformed struct arguments or field selections and read internal Elixir terms, including any state the failing pipeline step carried, from the error response."
}
],
"value": "Any client able to call the RPC endpoint can submit malformed struct arguments or field selections and read internal Elixir terms, including any state the failing pipeline step carried, from the error response."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-209",
"description": "CWE-209 Generation of Error Message Containing Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T11:16:30.582Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "GitHub Advisory",
"tags": [
"related",
"vendor-advisory"
],
"url": "https://github.com/ash-project/ash_typescript/security/advisories/GHSA-7gxc-w225-f7f3"
},
{
"name": "EEF CNA record for CVE-2026-105283",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-105283.html"
},
{
"name": "OSV record EEF-CVE-2026-105283",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-105283"
},
{
"name": "Introducing commit 8e204ce in ash-project/ash_typescript",
"tags": [
"related"
],
"url": "https://github.com/ash-project/ash_typescript/commit/8e204ce34e24a158cf22a2dac4d53c44716c9e30"
},
{
"name": "Fix commit 4b3c652 in ash-project/ash_typescript",
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_typescript/commit/4b3c65203ee78dc992d6d2e6559625c5460a01cd"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Internal error terms inspected into AshTypescript RPC error responses",
"x_proofOfConcept": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003col\u003e\n\u003cli\u003eExpose an AshTypescript RPC action that takes a struct-typed argument, for example an \u003ccode\u003eassignee\u003c/code\u003e argument whose struct has a UUID \u003ccode\u003eid\u003c/code\u003e field.\u003c/li\u003e\n\u003cli\u003eSend the action request with an invalid nested value, such as \u003ccode\u003e{\"assignee\": {\"id\": \"not-a-uuid\", \"name\": \"x\", \"email\": \"e\"}}\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eRead the response: each pair of the raw \u003ccode\u003eAsh.Type\u003c/code\u003e cast error is returned as its own \u003ccode\u003efield_validation_error\u003c/code\u003e with the inspected term in \u003ccode\u003edetails.error\u003c/code\u003e.\u003c/li\u003e\n\u003c/ol\u003e\n\u003cp\u003eFor the second path, send a \u003ccode\u003efields\u003c/code\u003e list to a generic action that returns a primitive and read the inspected \u003ccode\u003eAsh.Info.Manifest.Type\u003c/code\u003e struct in \u003ccode\u003evars.returnType\u003c/code\u003e of the resulting error.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "1. Expose an AshTypescript RPC action that takes a struct-typed argument, for example an `assignee` argument whose struct has a UUID `id` field.\n2. Send the action request with an invalid nested value, such as `{\"assignee\": {\"id\": \"not-a-uuid\", \"name\": \"x\", \"email\": \"e\"}}`.\n3. Read the response: each pair of the raw `Ash.Type` cast error is returned as its own `field_validation_error` with the inspected term in `details.error`.\n\nFor the second path, send a `fields` list to a generic action that returns a primitive and read the inspected `Ash.Info.Manifest.Type` struct in `vars.returnType` of the resulting error."
}
],
"value": "* Expose an AshTypescript RPC action that takes a struct-typed argument, for example an assignee argument whose struct has a UUID id field.\n* Send the action request with an invalid nested value, such as {\"assignee\": {\"id\": \"not-a-uuid\", \"name\": \"x\", \"email\": \"e\"}}.\n* Read the response: each pair of the raw Ash.Type cast error is returned as its own field_validation_error with the inspected term in details.error.\n\nFor the second path, send a fields list to a generic action that returns a primitive and read the inspected Ash.Info.Manifest.Type struct in vars.returnType of the resulting error."
}
],
"x_technicalAnalysis": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cstrong\u003e1. Error funnel.\u003c/strong\u003e \u003ccode\u003eAshTypescript.Rpc.run_action/3\u003c/code\u003e runs the request through \u003ccode\u003ePipeline.parse_request/3\u003c/code\u003e, \u003ccode\u003eexecute_ash_action/1\u003c/code\u003e and \u003ccode\u003eprocess_result/2\u003c/code\u003e. Any \u003ccode\u003e{:error, reason}\u003c/code\u003e from these goes to \u003ccode\u003eerror_response/1\u003c/code\u003e, which calls \u003ccode\u003eAshTypescript.Rpc.ErrorBuilder.build_error_response/1\u003c/code\u003e with the raw reason term.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e2. Unredacted fallbacks.\u003c/strong\u003e \u003ccode\u003ebuild_error_response/1\u003c/code\u003e has clauses for the error tuples the pipeline is expected to emit. A two-tuple whose first element is an atom but matches no clause is rendered as \u003ccode\u003efield_validation_error\u003c/code\u003e with \u003ccode\u003edetails.error\u003c/code\u003e set to \u003ccode\u003einspect(error)\u003c/code\u003e, and any other term becomes \u003ccode\u003eunknown_error\u003c/code\u003e with \u003ccode\u003edetails.error\u003c/code\u003e set to \u003ccode\u003einspect(other)\u003c/code\u003e. Ash exceptions never reach these clauses because \u003ccode\u003eAshTypescript.Rpc.Errors\u003c/code\u003e handles them and redacts unhandled ones behind an \u003ccode\u003eerrorId\u003c/code\u003e, so only this path has no redaction.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e3. Reachable triggers.\u003c/strong\u003e \u003ccode\u003eAshTypescript.Rpc.InputFormatter.cast_map_to_struct/2\u003c/code\u003e throws the raw \u003ccode\u003eAsh.Type.cast_input/3\u003c/code\u003e error, a keyword list, when a struct-typed argument fails to cast, and \u003ccode\u003eformat/6\u003c/code\u003e turns the throw into \u003ccode\u003e{:error, term}\u003c/code\u003e for the funnel. Separately, requesting \u003ccode\u003efields\u003c/code\u003e on a generic action whose return type is a primitive produces an \u003ccode\u003e{:invalid_field_selection, :primitive_type, return_type, ...}\u003c/code\u003e tuple whose \u003ccode\u003ereturn_type\u003c/code\u003e is formatted by \u003ccode\u003eformat_field_type/1\u003c/code\u003e, which inspects the whole \u003ccode\u003eAsh.Info.Manifest.Type\u003c/code\u003e struct, constraints and decoration included, into \u003ccode\u003evars.returnType\u003c/code\u003e.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "**1. Error funnel.** `AshTypescript.Rpc.run_action/3` runs the request through `Pipeline.parse_request/3`, `execute_ash_action/1` and `process_result/2`. Any `{:error, reason}` from these goes to `error_response/1`, which calls `AshTypescript.Rpc.ErrorBuilder.build_error_response/1` with the raw reason term.\n\n**2. Unredacted fallbacks.** `build_error_response/1` has clauses for the error tuples the pipeline is expected to emit. A two-tuple whose first element is an atom but matches no clause is rendered as `field_validation_error` with `details.error` set to `inspect(error)`, and any other term becomes `unknown_error` with `details.error` set to `inspect(other)`. Ash exceptions never reach these clauses because `AshTypescript.Rpc.Errors` handles them and redacts unhandled ones behind an `errorId`, so only this path has no redaction.\n\n**3. Reachable triggers.** `AshTypescript.Rpc.InputFormatter.cast_map_to_struct/2` throws the raw `Ash.Type.cast_input/3` error, a keyword list, when a struct-typed argument fails to cast, and `format/6` turns the throw into `{:error, term}` for the funnel. Separately, requesting `fields` on a generic action whose return type is a primitive produces an `{:invalid_field_selection, :primitive_type, return_type, ...}` tuple whose `return_type` is formatted by `format_field_type/1`, which inspects the whole `Ash.Info.Manifest.Type` struct, constraints and decoration included, into `vars.returnType`."
}
],
"value": "1. Error funnel. AshTypescript.Rpc.run_action/3 runs the request through Pipeline.parse_request/3, execute_ash_action/1 and process_result/2. Any {:error, reason} from these goes to error_response/1, which calls AshTypescript.Rpc.ErrorBuilder.build_error_response/1 with the raw reason term.\n\n2. Unredacted fallbacks. build_error_response/1 has clauses for the error tuples the pipeline is expected to emit. A two-tuple whose first element is an atom but matches no clause is rendered as field_validation_error with details.error set to inspect(error), and any other term becomes unknown_error with details.error set to inspect(other). Ash exceptions never reach these clauses because AshTypescript.Rpc.Errors handles them and redacts unhandled ones behind an errorId, so only this path has no redaction.\n\n3. Reachable triggers. AshTypescript.Rpc.InputFormatter.cast_map_to_struct/2 throws the raw Ash.Type.cast_input/3 error, a keyword list, when a struct-typed argument fails to cast, and format/6 turns the throw into {:error, term} for the funnel. Separately, requesting fields on a generic action whose return type is a primitive produces an {:invalid_field_selection, :primitive_type, return_type, ...} tuple whose return_type is formatted by format_field_type/1, which inspects the whole Ash.Info.Manifest.Type struct, constraints and decoration included, into vars.returnType."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-105283",
"datePublished": "2026-10-12T11:16:30.582Z",
"dateReserved": "2026-10-10T13:15:02.310Z",
"dateUpdated": "2026-10-16T16:53:18.072Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-101028 (GCVE-0-2026-101028)
Vulnerability from cvelistv5 – Published: 2026-10-09 07:01 – Updated: 2026-10-09 18:04
VLAI
EPSS
VEX
Title
Ash.count, Ash.exists and Ash.aggregate skip related resources' read policies in filters and sorts
Summary
Incorrect Authorization vulnerability in ash-project ash allows an actor to infer data in related records they cannot read via Ash.count/2, Ash.exists/2 and Ash.aggregate/3.
Ash.Actions.Aggregate.run/4 (lib/ash/actions/aggregate.ex) applied only the root resource's read policy before running the aggregate query. The read path also applies each related resource's read policy to filter and sort references that cross a relationship, directly (for example comments.body) or through an aggregate over one, but the aggregate path skipped that step. A caller whose filter or sort reaches these functions, for example through Ash.Query.filter_input/2, an ash_lua script, or an AshAi tool offering count or exists results, can test conditions against related rows hidden from them and recover their existence and attribute values one query at a time. Ash.read/2 and its page counts are not affected.
This issue affects ash: from 2.6.0 before 3.34.6.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-09 18:03 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash/security/advis… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-101028.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-101028 | related |
| https://github.com/ash-project/ash/commit/30eaf1c… | related |
| https://github.com/ash-project/ash/commit/8093618… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash |
Affected:
2.6.0 , < 3.34.6
(semver)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
|
| ash-project | ash |
Affected:
30eaf1c6e8524527b703e3c4bfeff7967ee0b37c , < 80936187b27ee94f15cd875affd3141b5cb23185
(git)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-101028",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-09T18:03:54.666261Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T18:04:24.729Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-xj24-8f5c-pp5p"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Actions.Aggregate\u0027",
"\u0027Elixir.Ash\u0027"
],
"packageName": "ash",
"packageURL": "pkg:hex/ash",
"product": "ash",
"programFiles": [
"lib/ash/actions/aggregate.ex",
"lib/ash.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Actions.Aggregate\u0027:run/4"
},
{
"name": "\u0027Elixir.Ash\u0027:count/2"
},
{
"name": "\u0027Elixir.Ash\u0027:exists/2"
},
{
"name": "\u0027Elixir.Ash\u0027:aggregate/3"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "3.34.6",
"status": "affected",
"version": "2.6.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Actions.Aggregate\u0027",
"\u0027Elixir.Ash\u0027"
],
"packageName": "ash-project/ash",
"packageURL": "pkg:github/ash-project/ash",
"product": "ash",
"programFiles": [
"lib/ash/actions/aggregate.ex",
"lib/ash.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Actions.Aggregate\u0027:run/4"
},
{
"name": "\u0027Elixir.Ash\u0027:count/2"
},
{
"name": "\u0027Elixir.Ash\u0027:exists/2"
},
{
"name": "\u0027Elixir.Ash\u0027:aggregate/3"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "80936187b27ee94f15cd875affd3141b5cb23185",
"status": "affected",
"version": "30eaf1c6e8524527b703e3c4bfeff7967ee0b37c",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eReachable only when an application passes caller-supplied filters or sorts that cross a relationship into \u003ccode\u003eAsh.count/2\u003c/code\u003e, \u003ccode\u003eAsh.exists/2\u003c/code\u003e or \u003ccode\u003eAsh.aggregate/3\u003c/code\u003e (directly, through ash_lua read operations, or through AshAi count, exists or aggregate result types), and a related resource\u0027s read policy is stricter than the root resource\u0027s.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Reachable only when an application passes caller-supplied filters or sorts that cross a relationship into `Ash.count/2`, `Ash.exists/2` or `Ash.aggregate/3` (directly, through ash_lua read operations, or through AshAi count, exists or aggregate result types), and a related resource\u0027s read policy is stricter than the root resource\u0027s."
}
],
"value": "Reachable only when an application passes caller-supplied filters or sorts that cross a relationship into Ash.count/2, Ash.exists/2 or Ash.aggregate/3 (directly, through ash_lua read operations, or through AshAi count, exists or aggregate result types), and a related resource\u0027s read policy is stricter than the root resource\u0027s."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.34.6",
"versionStartIncluding": "2.6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Glenn Rempe"
},
{
"lang": "en",
"type": "finder",
"value": "Glenn Rempe"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
}
],
"dateAssigned": "2026-10-09T00:19:31.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIncorrect Authorization vulnerability in ash-project ash allows an actor to infer data in related records they cannot read via \u003ccode\u003eAsh.count/2\u003c/code\u003e, \u003ccode\u003eAsh.exists/2\u003c/code\u003e and \u003ccode\u003eAsh.aggregate/3\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eAsh.Actions.Aggregate.run/4\u003c/code\u003e (\u003ccode\u003elib/ash/actions/aggregate.ex\u003c/code\u003e) applied only the root resource\u0027s read policy before running the aggregate query. The read path also applies each related resource\u0027s read policy to filter and sort references that cross a relationship, directly (for example \u003ccode\u003ecomments.body\u003c/code\u003e) or through an aggregate over one, but the aggregate path skipped that step. A caller whose filter or sort reaches these functions, for example through \u003ccode\u003eAsh.Query.filter_input/2\u003c/code\u003e, an ash_lua script, or an AshAi tool offering count or exists results, can test conditions against related rows hidden from them and recover their existence and attribute values one query at a time. \u003ccode\u003eAsh.read/2\u003c/code\u003e and its page counts are not affected.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash: from 2.6.0 before 3.34.6.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Incorrect Authorization vulnerability in ash-project ash allows an actor to infer data in related records they cannot read via `Ash.count/2`, `Ash.exists/2` and `Ash.aggregate/3`.\n\n`Ash.Actions.Aggregate.run/4` (`lib/ash/actions/aggregate.ex`) applied only the root resource\u0027s read policy before running the aggregate query. The read path also applies each related resource\u0027s read policy to filter and sort references that cross a relationship, directly (for example `comments.body`) or through an aggregate over one, but the aggregate path skipped that step. A caller whose filter or sort reaches these functions, for example through `Ash.Query.filter_input/2`, an ash_lua script, or an AshAi tool offering count or exists results, can test conditions against related rows hidden from them and recover their existence and attribute values one query at a time. `Ash.read/2` and its page counts are not affected.\n\nThis issue affects ash: from 2.6.0 before 3.34.6."
}
],
"value": "Incorrect Authorization vulnerability in ash-project ash allows an actor to infer data in related records they cannot read via Ash.count/2, Ash.exists/2 and Ash.aggregate/3.\n\nAsh.Actions.Aggregate.run/4 (lib/ash/actions/aggregate.ex) applied only the root resource\u0027s read policy before running the aggregate query. The read path also applies each related resource\u0027s read policy to filter and sort references that cross a relationship, directly (for example comments.body) or through an aggregate over one, but the aggregate path skipped that step. A caller whose filter or sort reaches these functions, for example through Ash.Query.filter_input/2, an ash_lua script, or an AshAi tool offering count or exists results, can test conditions against related rows hidden from them and recover their existence and attribute values one query at a time. Ash.read/2 and its page counts are not affected.\n\nThis issue affects ash: from 2.6.0 before 3.34.6."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T07:01:06.470Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "GHSA-xj24-8f5c-pp5p",
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-xj24-8f5c-pp5p"
},
{
"name": "EEF CNA record for CVE-2026-101028",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-101028.html"
},
{
"name": "OSV record EEF-CVE-2026-101028",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-101028"
},
{
"name": "Introducing commit 30eaf1c in ash-project/ash",
"tags": [
"related"
],
"url": "https://github.com/ash-project/ash/commit/30eaf1c6e8524527b703e3c4bfeff7967ee0b37c"
},
{
"name": "Fix commit 8093618 in ash-project/ash",
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash/commit/80936187b27ee94f15cd875affd3141b5cb23185"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Ash.count, Ash.exists and Ash.aggregate skip related resources\u0027 read policies in filters and sorts"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-101028",
"datePublished": "2026-10-09T07:01:06.470Z",
"dateReserved": "2026-10-08T15:45:02.376Z",
"dateUpdated": "2026-10-09T18:04:24.729Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-94201 (GCVE-0-2026-94201)
Vulnerability from cvelistv5 – Published: 2026-10-05 19:19 – Updated: 2026-10-06 13:41
VLAI
EPSS
VEX
Title
Filtering an :atom attribute with unsafe_to_atom? can exhaust the BEAM atom table in Ash
Summary
Ash stores :atom-typed attributes as strings and compares them as strings. When such an attribute is referenced in a filter, the comparison value is coerced through Ash.Type.Atom. Because the type defined no coerce/2 callback, coercion fell back to the default (cast_input/2), which calls String.to_atom/1 when the attribute is configured with the unsafe_to_atom?: true constraint.
Filtering such an attribute with attacker-controlled strings therefore interned a new, permanent atom for every distinct value. Atoms are never garbage collected and the BEAM caps the atom table, so an actor who can supply filter values for a public, filterable :atom attribute declared with unsafe_to_atom?: true can exhaust the atom table and crash the node (denial of service). AshPaperTrail is a notable example: its version resources expose a public, filterable version_action_name atom attribute with unsafe_to_atom?: true by default.
The fix adds a coerce/2 to Ash.Type.Atom that never interns atoms — a comparison value is left as a string, since the type is stored and compared as a string. Setting the attribute from action input (cast_input/2, which still honors unsafe_to_atom?) is unchanged.
This issue affects ash: from 3.5.1 before 3.34.3.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 13:41 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://cna.erlef.org/cves/CVE-2026-94201.html | relatedthird-party-advisory |
| https://osv.dev/vulnerability/EEF-CVE-2026-94201 | related |
| https://github.com/ash-project/ash/commit/2970ba3… | related |
| https://github.com/ash-project/ash/commit/5282f3f… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash |
Affected:
3.5.1 , < 3.34.3
(semver)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
|
| ash-project | ash |
Affected:
2970ba3bd5d36d6ad04c731ac87385375d457147 , < 5282f3f513053628cdd1bf2236ea22d975d934d4
(git)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-94201",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T13:41:07.117450Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T13:41:22.142Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Type.Atom\u0027"
],
"packageName": "ash",
"packageURL": "pkg:hex/ash",
"product": "ash",
"programFiles": [
"lib/ash/type/atom.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Type.Atom\u0027:cast_value/2"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "3.34.3",
"status": "affected",
"version": "3.5.1",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Type.Atom\u0027"
],
"packageName": "ash-project/ash",
"packageURL": "pkg:github/ash-project/ash",
"product": "ash",
"programFiles": [
"lib/ash/type/atom.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Type.Atom\u0027:cast_value/2"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "5282f3f513053628cdd1bf2236ea22d975d934d4",
"status": "affected",
"version": "2970ba3bd5d36d6ad04c731ac87385375d457147",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eReachable only when an application exposes a public, filterable \u003ccode\u003e:atom\u003c/code\u003e attribute declared with the \u003ccode\u003eunsafe_to_atom?: true\u003c/code\u003e constraint, and an actor can supply filter values for it (for example through AshGraphql, AshJsonApi, or \u003ccode\u003eAsh.Query.filter_input/2\u003c/code\u003e). AshPaperTrail\u0027s version resources ship such an attribute (\u003ccode\u003eversion_action_name\u003c/code\u003e) by default.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Reachable only when an application exposes a public, filterable `:atom` attribute declared with the `unsafe_to_atom?: true` constraint, and an actor can supply filter values for it (for example through AshGraphql, AshJsonApi, or `Ash.Query.filter_input/2`). AshPaperTrail\u0027s version resources ship such an attribute (`version_action_name`) by default."
}
],
"value": "Reachable only when an application exposes a public, filterable :atom attribute declared with the unsafe_to_atom?: true constraint, and an actor can supply filter values for it (for example through AshGraphql, AshJsonApi, or Ash.Query.filter_input/2). AshPaperTrail\u0027s version resources ship such an attribute (version_action_name) by default."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.34.3",
"versionStartIncluding": "3.5.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Quinn Wilton"
},
{
"lang": "en",
"type": "reporter",
"value": "Quinn Wilton"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"dateAssigned": "2026-10-04T15:49:18.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAsh stores \u003ccode\u003e:atom\u003c/code\u003e-typed attributes as strings and compares them as strings. When such an attribute is referenced in a filter, the comparison value is coerced through \u003ccode\u003eAsh.Type.Atom\u003c/code\u003e. Because the type defined no \u003ccode\u003ecoerce/2\u003c/code\u003e callback, coercion fell back to the default (\u003ccode\u003ecast_input/2\u003c/code\u003e), which calls \u003ccode\u003eString.to_atom/1\u003c/code\u003e when the attribute is configured with the \u003ccode\u003eunsafe_to_atom?: true\u003c/code\u003e constraint.\u003c/p\u003e\n\u003cp\u003eFiltering such an attribute with attacker-controlled strings therefore interned a new, permanent atom for every distinct value. Atoms are never garbage collected and the BEAM caps the atom table, so an actor who can supply filter values for a public, filterable \u003ccode\u003e:atom\u003c/code\u003e attribute declared with \u003ccode\u003eunsafe_to_atom?: true\u003c/code\u003e can exhaust the atom table and crash the node (denial of service). AshPaperTrail is a notable example: its version resources expose a public, filterable \u003ccode\u003eversion_action_name\u003c/code\u003e atom attribute with \u003ccode\u003eunsafe_to_atom?: true\u003c/code\u003e by default.\u003c/p\u003e\n\u003cp\u003eThe fix adds a \u003ccode\u003ecoerce/2\u003c/code\u003e to \u003ccode\u003eAsh.Type.Atom\u003c/code\u003e that never interns atoms \u2014 a comparison value is left as a string, since the type is stored and compared as a string. Setting the attribute from action input (\u003ccode\u003ecast_input/2\u003c/code\u003e, which still honors \u003ccode\u003eunsafe_to_atom?\u003c/code\u003e) is unchanged.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash: from 3.5.1 before 3.34.3.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Ash stores `:atom`-typed attributes as strings and compares them as strings. When such an attribute is referenced in a filter, the comparison value is coerced through `Ash.Type.Atom`. Because the type defined no `coerce/2` callback, coercion fell back to the default (`cast_input/2`), which calls `String.to_atom/1` when the attribute is configured with the `unsafe_to_atom?: true` constraint.\n\nFiltering such an attribute with attacker-controlled strings therefore interned a new, permanent atom for every distinct value. Atoms are never garbage collected and the BEAM caps the atom table, so an actor who can supply filter values for a public, filterable `:atom` attribute declared with `unsafe_to_atom?: true` can exhaust the atom table and crash the node (denial of service). AshPaperTrail is a notable example: its version resources expose a public, filterable `version_action_name` atom attribute with `unsafe_to_atom?: true` by default.\n\nThe fix adds a `coerce/2` to `Ash.Type.Atom` that never interns atoms \u2014 a comparison value is left as a string, since the type is stored and compared as a string. Setting the attribute from action input (`cast_input/2`, which still honors `unsafe_to_atom?`) is unchanged.\n\nThis issue affects ash: from 3.5.1 before 3.34.3."
}
],
"value": "Ash stores :atom-typed attributes as strings and compares them as strings. When such an attribute is referenced in a filter, the comparison value is coerced through Ash.Type.Atom. Because the type defined no coerce/2 callback, coercion fell back to the default (cast_input/2), which calls String.to_atom/1 when the attribute is configured with the unsafe_to_atom?: true constraint.\n\nFiltering such an attribute with attacker-controlled strings therefore interned a new, permanent atom for every distinct value. Atoms are never garbage collected and the BEAM caps the atom table, so an actor who can supply filter values for a public, filterable :atom attribute declared with unsafe_to_atom?: true can exhaust the atom table and crash the node (denial of service). AshPaperTrail is a notable example: its version resources expose a public, filterable version_action_name atom attribute with unsafe_to_atom?: true by default.\n\nThe fix adds a coerce/2 to Ash.Type.Atom that never interns atoms \u2014 a comparison value is left as a string, since the type is stored and compared as a string. Setting the attribute from action input (cast_input/2, which still honors unsafe_to_atom?) is unchanged.\n\nThis issue affects ash: from 3.5.1 before 3.34.3."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-130 Excessive Allocation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T19:19:51.326Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "EEF CNA record for CVE-2026-94201",
"tags": [
"related",
"third-party-advisory"
],
"url": "https://cna.erlef.org/cves/CVE-2026-94201.html"
},
{
"name": "OSV record EEF-CVE-2026-94201",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-94201"
},
{
"name": "Introducing commit 2970ba3 in ash-project/ash",
"tags": [
"related"
],
"url": "https://github.com/ash-project/ash/commit/2970ba3bd5d36d6ad04c731ac87385375d457147"
},
{
"name": "Fix commit 5282f3f in ash-project/ash",
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash/commit/5282f3f513053628cdd1bf2236ea22d975d934d4"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Filtering an :atom attribute with unsafe_to_atom? can exhaust the BEAM atom table in Ash"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-94201",
"datePublished": "2026-10-05T19:19:51.326Z",
"dateReserved": "2026-09-24T09:15:02.216Z",
"dateUpdated": "2026-10-06T13:41:22.142Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93477 (GCVE-0-2026-93477)
Vulnerability from cvelistv5 – Published: 2026-09-25 07:08 – Updated: 2026-09-25 13:26
VLAI
EPSS
VEX
Title
Private action arguments can be set by user input on the bulk destroy and bulk update paths in Ash
Summary
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash allows a user to set the value of a private action argument on the bulk destroy and bulk update paths.
Action arguments declared with public?: false are meant to be set only by trusted server-side code (for example via Ash.Changeset.set_private_argument/3) and must not be settable from end-user input. CVE-2026-55736 fixed the non-bulk changeset path to strip private arguments from user-supplied parameter maps, but the bulk destroy and bulk update paths were not covered.
Ash.Actions.Destroy.Bulk.base_changeset/5 and Ash.Actions.Update.Bulk.base_changeset/5 match every key in the caller-supplied parameter map against all of the action's arguments with no public? check, then apply the matches to the base changeset. A caller who can submit parameters to a bulk destroy or bulk update action (for example through AshJsonApi, AshGraphql, or a controller that forwards request parameters to Ash.bulk_destroy/4 or Ash.bulk_update/4) can therefore set any private argument of that action, including one referenced by an arg(...) template in the action's changes or validations. Depending on how the application uses the argument (for example an acting_user_id driving authorization or record ownership, or audit metadata), this can lead to an integrity violation or privilege escalation.
The fix requires public? in the argument matching on both bulk paths; private arguments remain settable server-side via the :private_arguments option.
This issue affects ash: from 2.17.15 before 3.33.11.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-25 13:26 UTC
CWE
- CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes
Assigner
References
5 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash |
Affected:
2.17.15 , < 3.33.11
(semver)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
|
| ash-project | ash |
Affected:
8c17434803b2e91de522bdfbd0ca918e5d5898df , < 6b7ac53a0a2532291eb940d7beaf0fbb2da6fc4f
(git)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-93477",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-25T13:26:14.200048Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T13:26:42.369Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-c2p4-p7q6-hr2j"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Actions.Destroy.Bulk\u0027",
"\u0027Elixir.Ash.Actions.Update.Bulk\u0027"
],
"packageName": "ash",
"packageURL": "pkg:hex/ash",
"product": "ash",
"programFiles": [
"lib/ash/actions/destroy/bulk.ex",
"lib/ash/actions/update/bulk.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Actions.Destroy.Bulk\u0027:base_changeset/5"
},
{
"name": "\u0027Elixir.Ash.Actions.Update.Bulk\u0027:base_changeset/5"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "3.33.11",
"status": "affected",
"version": "2.17.15",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Actions.Destroy.Bulk\u0027",
"\u0027Elixir.Ash.Actions.Update.Bulk\u0027"
],
"packageName": "ash-project/ash",
"packageURL": "pkg:github/ash-project/ash",
"product": "ash",
"programFiles": [
"lib/ash/actions/destroy/bulk.ex",
"lib/ash/actions/update/bulk.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Actions.Destroy.Bulk\u0027:base_changeset/5"
},
{
"name": "\u0027Elixir.Ash.Actions.Update.Bulk\u0027:base_changeset/5"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "6b7ac53a0a2532291eb940d7beaf0fbb2da6fc4f",
"status": "affected",
"version": "8c17434803b2e91de522bdfbd0ca918e5d5898df",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn action must declare a private argument (\u003ccode\u003epublic?: false\u003c/code\u003e) that is referenced by an \u003ccode\u003earg(...)\u003c/code\u003e template in one of its changes or validations, be invocable as a bulk destroy or bulk update, and the application must pass untrusted user-supplied parameters into \u003ccode\u003eAsh.bulk_destroy/4\u003c/code\u003e or \u003ccode\u003eAsh.bulk_update/4\u003c/code\u003e (directly or through AshJsonApi/AshGraphql).\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "An action must declare a private argument (`public?: false`) that is referenced by an `arg(...)` template in one of its changes or validations, be invocable as a bulk destroy or bulk update, and the application must pass untrusted user-supplied parameters into `Ash.bulk_destroy/4` or `Ash.bulk_update/4` (directly or through AshJsonApi/AshGraphql)."
}
],
"value": "An action must declare a private argument (public?: false) that is referenced by an arg(...) template in one of its changes or validations, be invocable as a bulk destroy or bulk update, and the application must pass untrusted user-supplied parameters into Ash.bulk_destroy/4 or Ash.bulk_update/4 (directly or through AshJsonApi/AshGraphql)."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.33.11",
"versionStartIncluding": "2.17.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "zx"
},
{
"lang": "en",
"type": "reporter",
"value": "zx"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"dateAssigned": "2026-09-25T06:50:10.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash allows a user to set the value of a private action argument on the bulk destroy and bulk update paths.\u003c/p\u003e\n\u003cp\u003eAction arguments declared with \u003ccode\u003epublic?: false\u003c/code\u003e are meant to be set only by trusted server-side code (for example via \u003ccode\u003eAsh.Changeset.set_private_argument/3\u003c/code\u003e) and must not be settable from end-user input. CVE-2026-55736 fixed the non-bulk changeset path to strip private arguments from user-supplied parameter maps, but the bulk destroy and bulk update paths were not covered.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eAsh.Actions.Destroy.Bulk.base_changeset/5\u003c/code\u003e and \u003ccode\u003eAsh.Actions.Update.Bulk.base_changeset/5\u003c/code\u003e match every key in the caller-supplied parameter map against all of the action\u0027s arguments with no \u003ccode\u003epublic?\u003c/code\u003e check, then apply the matches to the base changeset. A caller who can submit parameters to a bulk destroy or bulk update action (for example through AshJsonApi, AshGraphql, or a controller that forwards request parameters to \u003ccode\u003eAsh.bulk_destroy/4\u003c/code\u003e or \u003ccode\u003eAsh.bulk_update/4\u003c/code\u003e) can therefore set any private argument of that action, including one referenced by an \u003ccode\u003earg(...)\u003c/code\u003e template in the action\u0027s changes or validations. Depending on how the application uses the argument (for example an \u003ccode\u003eacting_user_id\u003c/code\u003e driving authorization or record ownership, or audit metadata), this can lead to an integrity violation or privilege escalation.\u003c/p\u003e\n\u003cp\u003eThe fix requires \u003ccode\u003epublic?\u003c/code\u003e in the argument matching on both bulk paths; private arguments remain settable server-side via the \u003ccode\u003e:private_arguments\u003c/code\u003e option.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash: from 2.17.15 before 3.33.11.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash allows a user to set the value of a private action argument on the bulk destroy and bulk update paths.\n\nAction arguments declared with `public?: false` are meant to be set only by trusted server-side code (for example via `Ash.Changeset.set_private_argument/3`) and must not be settable from end-user input. CVE-2026-55736 fixed the non-bulk changeset path to strip private arguments from user-supplied parameter maps, but the bulk destroy and bulk update paths were not covered.\n\n`Ash.Actions.Destroy.Bulk.base_changeset/5` and `Ash.Actions.Update.Bulk.base_changeset/5` match every key in the caller-supplied parameter map against all of the action\u0027s arguments with no `public?` check, then apply the matches to the base changeset. A caller who can submit parameters to a bulk destroy or bulk update action (for example through AshJsonApi, AshGraphql, or a controller that forwards request parameters to `Ash.bulk_destroy/4` or `Ash.bulk_update/4`) can therefore set any private argument of that action, including one referenced by an `arg(...)` template in the action\u0027s changes or validations. Depending on how the application uses the argument (for example an `acting_user_id` driving authorization or record ownership, or audit metadata), this can lead to an integrity violation or privilege escalation.\n\nThe fix requires `public?` in the argument matching on both bulk paths; private arguments remain settable server-side via the `:private_arguments` option.\n\nThis issue affects ash: from 2.17.15 before 3.33.11."
}
],
"value": "Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash allows a user to set the value of a private action argument on the bulk destroy and bulk update paths.\n\nAction arguments declared with public?: false are meant to be set only by trusted server-side code (for example via Ash.Changeset.set_private_argument/3) and must not be settable from end-user input. CVE-2026-55736 fixed the non-bulk changeset path to strip private arguments from user-supplied parameter maps, but the bulk destroy and bulk update paths were not covered.\n\nAsh.Actions.Destroy.Bulk.base_changeset/5 and Ash.Actions.Update.Bulk.base_changeset/5 match every key in the caller-supplied parameter map against all of the action\u0027s arguments with no public? check, then apply the matches to the base changeset. A caller who can submit parameters to a bulk destroy or bulk update action (for example through AshJsonApi, AshGraphql, or a controller that forwards request parameters to Ash.bulk_destroy/4 or Ash.bulk_update/4) can therefore set any private argument of that action, including one referenced by an arg(...) template in the action\u0027s changes or validations. Depending on how the application uses the argument (for example an acting_user_id driving authorization or record ownership, or audit metadata), this can lead to an integrity violation or privilege escalation.\n\nThe fix requires public? in the argument matching on both bulk paths; private arguments remain settable server-side via the :private_arguments option.\n\nThis issue affects ash: from 2.17.15 before 3.33.11."
}
],
"impacts": [
{
"capecId": "CAPEC-77",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-77 Manipulating User-Controlled Variables"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-915",
"description": "CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T07:08:55.191Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "GHSA-c2p4-p7q6-hr2j",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-c2p4-p7q6-hr2j"
},
{
"name": "EEF CNA record for CVE-2026-93477",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-93477.html"
},
{
"name": "OSV record EEF-CVE-2026-93477",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-93477"
},
{
"name": "Introducing commit 8c17434 in ash-project/ash",
"tags": [
"related"
],
"url": "https://github.com/ash-project/ash/commit/8c17434803b2e91de522bdfbd0ca918e5d5898df"
},
{
"name": "Fix commit 6b7ac53 in ash-project/ash",
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash/commit/6b7ac53a0a2532291eb940d7beaf0fbb2da6fc4f"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Private action arguments can be set by user input on the bulk destroy and bulk update paths in Ash"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-93477",
"datePublished": "2026-09-25T07:08:55.191Z",
"dateReserved": "2026-09-19T16:00:02.004Z",
"dateUpdated": "2026-09-25T13:26:42.369Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86338 (GCVE-0-2026-86338)
Vulnerability from cvelistv5 – Published: 2026-09-16 08:28 – Updated: 2026-09-16 14:49
VLAI
EPSS
VEX
Title
Ash field policies do not filter-nil forbidden calculations and aggregates, enabling an information-disclosure oracle
Summary
Ash field_policies are documented to protect against filter-based information disclosure: when a field the actor may not see is referenced in a filter, it is replaced with an expression that evaluates to nil, so a filter cannot be used as a yes/no oracle to read a value the actor cannot see.
This nilling was applied to attributes but not to calculations or aggregates. A user-supplied filter reference to a calculation or aggregate carries an Ash.Query.Calculation / Ash.Query.Aggregate struct, which the authorizer's reference replacement did not match (it only matched the Ash.Resource.* structs), so the filter ran against the real value.
As a result, an actor whose field policies forbid a calculation or aggregate can still filter by it (for example filter(secret_calc == "x") or filter(comment_count == n)) and learn the value from whether rows match — an oracle that recovers field-policy-protected values one probe at a time. Filtering is commonly exposed to lower-privileged actors (for example via AshGraphql or AshJsonApi filter arguments), which is exactly the surface field policies are meant to protect.
The fix routes filter references to calculations and aggregates through the same field-policy nilling as attributes.
This issue affects ash: from 2.11.0-rc.0 before 3.33.4.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 14:49 UTC
CWE
- CWE-1220 - Insufficient Granularity of Access Control
Assigner
References
5 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash |
Affected:
2.11.0-rc.0 , < 3.33.4
(semver)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
|
| ash-project | ash |
Affected:
0b6d93c7c4637280b46ae66ea1d2eaf013701238 , < b3d4503241f3deacb5ceb955e10a4fa927da0f67
(git)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86338",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T14:49:09.195379Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T14:49:17.203Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Policy.Authorizer\u0027"
],
"packageName": "ash",
"packageURL": "pkg:hex/ash",
"product": "ash",
"programFiles": [
"lib/ash/policy/authorizer/authorizer.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Policy.Authorizer\u0027:do_replace_ref/2"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "3.33.4",
"status": "affected",
"version": "2.11.0-rc.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Policy.Authorizer\u0027"
],
"packageName": "ash-project/ash",
"packageURL": "pkg:github/ash-project/ash",
"product": "ash",
"programFiles": [
"lib/ash/policy/authorizer/authorizer.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Policy.Authorizer\u0027:do_replace_ref/2"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "b3d4503241f3deacb5ceb955e10a4fa927da0f67",
"status": "affected",
"version": "0b6d93c7c4637280b46ae66ea1d2eaf013701238",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eReachable only when an application uses \u003ccode\u003eAsh.Policy.Authorizer\u003c/code\u003e field policies to restrict a calculation or aggregate, and exposes filtering on it to an actor who is denied that field (for example an authenticated user filtering through AshGraphql or AshJsonApi).\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Reachable only when an application uses `Ash.Policy.Authorizer` field policies to restrict a calculation or aggregate, and exposes filtering on it to an actor who is denied that field (for example an authenticated user filtering through AshGraphql or AshJsonApi)."
}
],
"value": "Reachable only when an application uses Ash.Policy.Authorizer field policies to restrict a calculation or aggregate, and exposes filtering on it to an actor who is denied that field (for example an authenticated user filtering through AshGraphql or AshJsonApi)."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.33.4",
"versionStartIncluding": "2.11.0-rc.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Jesse Williams"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "finder",
"value": "Jesse Williams"
}
],
"dateAssigned": "2026-09-15T23:33:34.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAsh \u003ccode\u003efield_policies\u003c/code\u003e are documented to protect against filter-based information disclosure: when a field the actor may not see is referenced in a filter, it is replaced with an expression that evaluates to \u003ccode\u003enil\u003c/code\u003e, so a filter cannot be used as a yes/no oracle to read a value the actor cannot see.\u003c/p\u003e\n\u003cp\u003eThis nilling was applied to attributes but not to calculations or aggregates. A user-supplied filter reference to a calculation or aggregate carries an \u003ccode\u003eAsh.Query.Calculation\u003c/code\u003e / \u003ccode\u003eAsh.Query.Aggregate\u003c/code\u003e struct, which the authorizer\u0027s reference replacement did not match (it only matched the \u003ccode\u003eAsh.Resource.*\u003c/code\u003e structs), so the filter ran against the real value.\u003c/p\u003e\n\u003cp\u003eAs a result, an actor whose field policies forbid a calculation or aggregate can still filter by it (for example \u003ccode\u003efilter(secret_calc == \"x\")\u003c/code\u003e or \u003ccode\u003efilter(comment_count == n)\u003c/code\u003e) and learn the value from whether rows match \u2014 an oracle that recovers field-policy-protected values one probe at a time. Filtering is commonly exposed to lower-privileged actors (for example via AshGraphql or AshJsonApi filter arguments), which is exactly the surface field policies are meant to protect.\u003c/p\u003e\n\u003cp\u003eThe fix routes filter references to calculations and aggregates through the same field-policy nilling as attributes.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash: from 2.11.0-rc.0 before 3.33.4.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Ash `field_policies` are documented to protect against filter-based information disclosure: when a field the actor may not see is referenced in a filter, it is replaced with an expression that evaluates to `nil`, so a filter cannot be used as a yes/no oracle to read a value the actor cannot see.\n\nThis nilling was applied to attributes but not to calculations or aggregates. A user-supplied filter reference to a calculation or aggregate carries an `Ash.Query.Calculation` / `Ash.Query.Aggregate` struct, which the authorizer\u0027s reference replacement did not match (it only matched the `Ash.Resource.*` structs), so the filter ran against the real value.\n\nAs a result, an actor whose field policies forbid a calculation or aggregate can still filter by it (for example `filter(secret_calc == \"x\")` or `filter(comment_count == n)`) and learn the value from whether rows match \u2014 an oracle that recovers field-policy-protected values one probe at a time. Filtering is commonly exposed to lower-privileged actors (for example via AshGraphql or AshJsonApi filter arguments), which is exactly the surface field policies are meant to protect.\n\nThe fix routes filter references to calculations and aggregates through the same field-policy nilling as attributes.\n\nThis issue affects ash: from 2.11.0-rc.0 before 3.33.4."
}
],
"value": "Ash field_policies are documented to protect against filter-based information disclosure: when a field the actor may not see is referenced in a filter, it is replaced with an expression that evaluates to nil, so a filter cannot be used as a yes/no oracle to read a value the actor cannot see.\n\nThis nilling was applied to attributes but not to calculations or aggregates. A user-supplied filter reference to a calculation or aggregate carries an Ash.Query.Calculation / Ash.Query.Aggregate struct, which the authorizer\u0027s reference replacement did not match (it only matched the Ash.Resource.* structs), so the filter ran against the real value.\n\nAs a result, an actor whose field policies forbid a calculation or aggregate can still filter by it (for example filter(secret_calc == \"x\") or filter(comment_count == n)) and learn the value from whether rows match \u2014 an oracle that recovers field-policy-protected values one probe at a time. Filtering is commonly exposed to lower-privileged actors (for example via AshGraphql or AshJsonApi filter arguments), which is exactly the surface field policies are meant to protect.\n\nThe fix routes filter references to calculations and aggregates through the same field-policy nilling as attributes.\n\nThis issue affects ash: from 2.11.0-rc.0 before 3.33.4."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1220",
"description": "CWE-1220 Insufficient Granularity of Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T08:28:44.114Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "GHSA-7qr8-wrvq-566q",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-7qr8-wrvq-566q"
},
{
"name": "EEF CNA record for CVE-2026-86338",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-86338.html"
},
{
"name": "OSV record EEF-CVE-2026-86338",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-86338"
},
{
"name": "Introducing commit 0b6d93c in ash-project/ash",
"tags": [
"related"
],
"url": "https://github.com/ash-project/ash/commit/0b6d93c7c4637280b46ae66ea1d2eaf013701238"
},
{
"name": "Fix commit b3d4503 in ash-project/ash",
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash/commit/b3d4503241f3deacb5ceb955e10a4fa927da0f67"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Ash field policies do not filter-nil forbidden calculations and aggregates, enabling an information-disclosure oracle"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-86338",
"datePublished": "2026-09-16T08:28:44.114Z",
"dateReserved": "2026-09-15T15:30:01.895Z",
"dateUpdated": "2026-09-16T14:49:17.203Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78216 (GCVE-0-2026-78216)
Vulnerability from cvelistv5 – Published: 2026-09-08 16:42 – Updated: 2026-09-08 17:27
VLAI
EPSS
VEX
Title
AshLua eval read operations can read field-policy-protected fields via aggregates
Summary
AshLua exposes Ash read actions to Lua scripts run through an eval action. A read call accepts an operation (list, min, max, first, sum, avg) that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value.
Ash field policies redact forbidden fields on returned records (replacing them with %Ash.ForbiddenField{}), but that redaction does not apply to aggregate values. A script could therefore read a field the calling actor's field policies forbid by requesting it as an aggregate instead of as a field. This includes fields that are public? true but restricted per-actor by a field policy, such as sensitive PII. The prior hardening only enforced the exposed-field allow-list (field visibility), which is a separate axis from per-actor field-policy authorization.
The fix authorizes the aggregated field against the resource's field policies, so aggregating over a field the actor may not see is refused or scoped to the rows where it is visible.
This issue affects ash_lua: from 0.1.0 before 0.2.2.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 17:26 UTC
CWE
- CWE-1220 - Insufficient Granularity of Access Control
Assigner
References
5 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_lua |
Affected:
0.1.0 , < 0.2.2
(semver)
cpe:2.3:a:ash-project:ash_lua:*:*:*:*:*:*:*:* |
|
| ash-project | ash_lua |
Affected:
8675e47cca81f36594083a7e63379bac9e123e72 , < 266a5dcc56d5015b6d316c10606169e753b07450
(git)
cpe:2.3:a:ash-project:ash_lua:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-78216",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T17:26:34.675766Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T17:27:08.856Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_lua:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshLua.Runtime\u0027"
],
"packageName": "ash_lua",
"packageURL": "pkg:hex/ash_lua",
"product": "ash_lua",
"programFiles": [
"lib/ash_lua/runtime.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshLua.Runtime\u0027:run_read_operation/5"
}
],
"repo": "https://github.com/ash-project/ash_lua",
"vendor": "ash-project",
"versions": [
{
"lessThan": "0.2.2",
"status": "affected",
"version": "0.1.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_lua:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshLua.Runtime\u0027"
],
"packageName": "ash-project/ash_lua",
"packageURL": "pkg:github/ash-project/ash_lua",
"product": "ash_lua",
"programFiles": [
"lib/ash_lua/runtime.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshLua.Runtime\u0027:run_read_operation/5"
}
],
"repo": "https://github.com/ash-project/ash_lua",
"vendor": "ash-project",
"versions": [
{
"lessThan": "266a5dcc56d5015b6d316c10606169e753b07450",
"status": "affected",
"version": "8675e47cca81f36594083a7e63379bac9e123e72",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eReachable only when an application exposes an AshLua \u003ccode\u003eeval\u003c/code\u003e action over a resource whose field policies restrict a field that the calling actor can still name as an operation aggregate (for example a \u003ccode\u003epublic? true\u003c/code\u003e but field-policy-protected attribute).\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Reachable only when an application exposes an AshLua `eval` action over a resource whose field policies restrict a field that the calling actor can still name as an operation aggregate (for example a `public? true` but field-policy-protected attribute)."
}
],
"value": "Reachable only when an application exposes an AshLua eval action over a resource whose field policies restrict a field that the calling actor can still name as an operation aggregate (for example a public? true but field-policy-protected attribute)."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_lua:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.2.2",
"versionStartIncluding": "0.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "finder",
"value": "Aaron Hong / Remedy"
}
],
"dateAssigned": "2026-09-08T15:43:48.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAshLua exposes Ash read actions to Lua scripts run through an \u003ccode\u003eeval\u003c/code\u003e action. A read call accepts an \u003ccode\u003eoperation\u003c/code\u003e (\u003ccode\u003elist\u003c/code\u003e, \u003ccode\u003emin\u003c/code\u003e, \u003ccode\u003emax\u003c/code\u003e, \u003ccode\u003efirst\u003c/code\u003e, \u003ccode\u003esum\u003c/code\u003e, \u003ccode\u003eavg\u003c/code\u003e) that builds an ad-hoc \u003ccode\u003eAsh.Query.Aggregate\u003c/code\u003e over a named field and returns its raw value.\u003c/p\u003e\n\u003cp\u003eAsh field policies redact forbidden fields on returned records (replacing them with \u003ccode\u003e%Ash.ForbiddenField{}\u003c/code\u003e), but that redaction does not apply to aggregate values. A script could therefore read a field the calling actor\u0027s field policies forbid by requesting it as an aggregate instead of as a field. This includes fields that are \u003ccode\u003epublic? true\u003c/code\u003e but restricted per-actor by a field policy, such as sensitive PII. The prior hardening only enforced the exposed-field allow-list (field visibility), which is a separate axis from per-actor field-policy authorization.\u003c/p\u003e\n\u003cp\u003eThe fix authorizes the aggregated field against the resource\u0027s field policies, so aggregating over a field the actor may not see is refused or scoped to the rows where it is visible.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_lua: from 0.1.0 before 0.2.2.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "AshLua exposes Ash read actions to Lua scripts run through an `eval` action. A read call accepts an `operation` (`list`, `min`, `max`, `first`, `sum`, `avg`) that builds an ad-hoc `Ash.Query.Aggregate` over a named field and returns its raw value.\n\nAsh field policies redact forbidden fields on returned records (replacing them with `%Ash.ForbiddenField{}`), but that redaction does not apply to aggregate values. A script could therefore read a field the calling actor\u0027s field policies forbid by requesting it as an aggregate instead of as a field. This includes fields that are `public? true` but restricted per-actor by a field policy, such as sensitive PII. The prior hardening only enforced the exposed-field allow-list (field visibility), which is a separate axis from per-actor field-policy authorization.\n\nThe fix authorizes the aggregated field against the resource\u0027s field policies, so aggregating over a field the actor may not see is refused or scoped to the rows where it is visible.\n\nThis issue affects ash_lua: from 0.1.0 before 0.2.2."
}
],
"value": "AshLua exposes Ash read actions to Lua scripts run through an eval action. A read call accepts an operation (list, min, max, first, sum, avg) that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value.\n\nAsh field policies redact forbidden fields on returned records (replacing them with %Ash.ForbiddenField{}), but that redaction does not apply to aggregate values. A script could therefore read a field the calling actor\u0027s field policies forbid by requesting it as an aggregate instead of as a field. This includes fields that are public? true but restricted per-actor by a field policy, such as sensitive PII. The prior hardening only enforced the exposed-field allow-list (field visibility), which is a separate axis from per-actor field-policy authorization.\n\nThe fix authorizes the aggregated field against the resource\u0027s field policies, so aggregating over a field the actor may not see is refused or scoped to the rows where it is visible.\n\nThis issue affects ash_lua: from 0.1.0 before 0.2.2."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1220",
"description": "CWE-1220 Insufficient Granularity of Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T16:42:20.908Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "GHSA-5whv-8rcp-x33j",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/ash-project/ash_lua/security/advisories/GHSA-5whv-8rcp-x33j"
},
{
"name": "EEF CNA record for CVE-2026-78216",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-78216.html"
},
{
"name": "OSV record EEF-CVE-2026-78216",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-78216"
},
{
"name": "Introducing commit 8675e47 in ash-project/ash_lua",
"tags": [
"related"
],
"url": "https://github.com/ash-project/ash_lua/commit/8675e47cca81f36594083a7e63379bac9e123e72"
},
{
"name": "Fix commit 266a5dc in ash-project/ash_lua",
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_lua/commit/266a5dcc56d5015b6d316c10606169e753b07450"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "AshLua eval read operations can read field-policy-protected fields via aggregates"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-78216",
"datePublished": "2026-09-08T16:42:20.908Z",
"dateReserved": "2026-08-31T00:45:02.446Z",
"dateUpdated": "2026-09-08T17:27:08.856Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78230 (GCVE-0-2026-78230)
Vulnerability from cvelistv5 – Published: 2026-09-08 16:41 – Updated: 2026-09-08 17:33
VLAI
EPSS
VEX
Title
AshAi aggregate tool can read field-policy-protected fields
Summary
AshAi exposes Ash read actions to language-model tool calls. The read tool accepts an aggregate result type (min, max, sum, avg) that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value.
Ash field policies redact forbidden fields on returned records (replacing them with %Ash.ForbiddenField{}), but that redaction does not apply to aggregate values. A tool caller could therefore read a field the calling actor's field policies forbid by requesting it as an aggregate; min/max in particular return an actual field value. This includes fields that are public? true but restricted per-actor by a field policy, such as sensitive PII. The tool's existing check only required the field to be public, which is a separate axis from per-actor field-policy authorization.
The fix authorizes the aggregated field against the resource's field policies, so aggregating over a field the actor may not see is refused or scoped to the rows where it is visible.
This issue affects ash_ai: from 0.1.0 before 1.0.3.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 17:33 UTC
CWE
- CWE-1220 - Insufficient Granularity of Access Control
Assigner
References
5 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_ai |
Affected:
0.1.0 , < 1.0.3
(semver)
cpe:2.3:a:ash-project:ash_ai:*:*:*:*:*:*:*:* |
|
| ash-project | ash_ai |
Affected:
2ba234b50946a3b8116190c8467f9f4dfa5edce7 , < 9c02de581625c342c9870a672830bff28c1d701e
(git)
cpe:2.3:a:ash-project:ash_ai:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-78230",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T17:33:49.017554Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T17:33:57.604Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_ai:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAi.Tool.Execution\u0027"
],
"packageName": "ash_ai",
"packageURL": "pkg:hex/ash_ai",
"product": "ash_ai",
"programFiles": [
"lib/ash_ai/tool/execution.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAi.Tool.Execution\u0027:execute_read/4"
}
],
"repo": "https://github.com/ash-project/ash_ai",
"vendor": "ash-project",
"versions": [
{
"lessThan": "1.0.3",
"status": "affected",
"version": "0.1.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_ai:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAi.Tool.Execution\u0027"
],
"packageName": "ash-project/ash_ai",
"packageURL": "pkg:github/ash-project/ash_ai",
"product": "ash_ai",
"programFiles": [
"lib/ash_ai/tool/execution.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAi.Tool.Execution\u0027:execute_read/4"
}
],
"repo": "https://github.com/ash-project/ash_ai",
"vendor": "ash-project",
"versions": [
{
"lessThan": "9c02de581625c342c9870a672830bff28c1d701e",
"status": "affected",
"version": "2ba234b50946a3b8116190c8467f9f4dfa5edce7",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eReachable only when an application exposes an AshAi read tool over a resource whose field policies restrict a field that the calling actor can still name as an aggregate (for example a \u003ccode\u003epublic? true\u003c/code\u003e but field-policy-protected attribute).\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Reachable only when an application exposes an AshAi read tool over a resource whose field policies restrict a field that the calling actor can still name as an aggregate (for example a `public? true` but field-policy-protected attribute)."
}
],
"value": "Reachable only when an application exposes an AshAi read tool over a resource whose field policies restrict a field that the calling actor can still name as an aggregate (for example a public? true but field-policy-protected attribute)."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_ai:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.0.3",
"versionStartIncluding": "0.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "finder",
"value": "Aaron Hong / Remedy"
}
],
"dateAssigned": "2026-09-08T15:44:25.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAshAi exposes Ash read actions to language-model tool calls. The read tool accepts an aggregate result type (\u003ccode\u003emin\u003c/code\u003e, \u003ccode\u003emax\u003c/code\u003e, \u003ccode\u003esum\u003c/code\u003e, \u003ccode\u003eavg\u003c/code\u003e) that builds an ad-hoc \u003ccode\u003eAsh.Query.Aggregate\u003c/code\u003e over a named field and returns its raw value.\u003c/p\u003e\n\u003cp\u003eAsh field policies redact forbidden fields on returned records (replacing them with \u003ccode\u003e%Ash.ForbiddenField{}\u003c/code\u003e), but that redaction does not apply to aggregate values. A tool caller could therefore read a field the calling actor\u0027s field policies forbid by requesting it as an aggregate; \u003ccode\u003emin\u003c/code\u003e/\u003ccode\u003emax\u003c/code\u003e in particular return an actual field value. This includes fields that are \u003ccode\u003epublic? true\u003c/code\u003e but restricted per-actor by a field policy, such as sensitive PII. The tool\u0027s existing check only required the field to be public, which is a separate axis from per-actor field-policy authorization.\u003c/p\u003e\n\u003cp\u003eThe fix authorizes the aggregated field against the resource\u0027s field policies, so aggregating over a field the actor may not see is refused or scoped to the rows where it is visible.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_ai: from 0.1.0 before 1.0.3.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "AshAi exposes Ash read actions to language-model tool calls. The read tool accepts an aggregate result type (`min`, `max`, `sum`, `avg`) that builds an ad-hoc `Ash.Query.Aggregate` over a named field and returns its raw value.\n\nAsh field policies redact forbidden fields on returned records (replacing them with `%Ash.ForbiddenField{}`), but that redaction does not apply to aggregate values. A tool caller could therefore read a field the calling actor\u0027s field policies forbid by requesting it as an aggregate; `min`/`max` in particular return an actual field value. This includes fields that are `public? true` but restricted per-actor by a field policy, such as sensitive PII. The tool\u0027s existing check only required the field to be public, which is a separate axis from per-actor field-policy authorization.\n\nThe fix authorizes the aggregated field against the resource\u0027s field policies, so aggregating over a field the actor may not see is refused or scoped to the rows where it is visible.\n\nThis issue affects ash_ai: from 0.1.0 before 1.0.3."
}
],
"value": "AshAi exposes Ash read actions to language-model tool calls. The read tool accepts an aggregate result type (min, max, sum, avg) that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value.\n\nAsh field policies redact forbidden fields on returned records (replacing them with %Ash.ForbiddenField{}), but that redaction does not apply to aggregate values. A tool caller could therefore read a field the calling actor\u0027s field policies forbid by requesting it as an aggregate; min/max in particular return an actual field value. This includes fields that are public? true but restricted per-actor by a field policy, such as sensitive PII. The tool\u0027s existing check only required the field to be public, which is a separate axis from per-actor field-policy authorization.\n\nThe fix authorizes the aggregated field against the resource\u0027s field policies, so aggregating over a field the actor may not see is refused or scoped to the rows where it is visible.\n\nThis issue affects ash_ai: from 0.1.0 before 1.0.3."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1220",
"description": "CWE-1220 Insufficient Granularity of Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T16:41:45.975Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "GHSA-v5rw-36x5-r5vx",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/ash-project/ash_ai/security/advisories/GHSA-v5rw-36x5-r5vx"
},
{
"name": "EEF CNA record for CVE-2026-78230",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-78230.html"
},
{
"name": "OSV record EEF-CVE-2026-78230",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-78230"
},
{
"name": "Introducing commit 2ba234b in ash-project/ash_ai",
"tags": [
"related"
],
"url": "https://github.com/ash-project/ash_ai/commit/2ba234b50946a3b8116190c8467f9f4dfa5edce7"
},
{
"name": "Fix commit 9c02de5 in ash-project/ash_ai",
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_ai/commit/9c02de581625c342c9870a672830bff28c1d701e"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "AshAi aggregate tool can read field-policy-protected fields"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-78230",
"datePublished": "2026-09-08T16:41:45.975Z",
"dateReserved": "2026-08-31T00:45:02.439Z",
"dateUpdated": "2026-09-08T17:33:57.604Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82710 (GCVE-0-2026-82710)
Vulnerability from cvelistv5 – Published: 2026-09-08 00:23 – Updated: 2026-09-08 14:45
VLAI
EPSS
VEX
Title
Terminal escape sequence injection in mix usage_rules.search_docs via package documentation metadata
Summary
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project usage_rules allows a malicious package publisher to inject terminal control sequences into the output of mix usage_rules.search_docs.
mix usage_rules.search_docs searches Hex documentation through search.hexdocs.pm, which indexes the documentation of every published package, and prints the matching results (title, package, type, doc reference, and highlighted snippets) to the terminal. The formatter in Mix.Tasks.UsageRules.SearchDocs interpolated those publisher-controlled fields verbatim, neutralizing no terminal control characters; the only transform it applied adds escape sequences rather than removing them. A malicious package can embed ANSI terminal escape sequences (cursor movement, line erase, carriage returns, OSC 52 clipboard writes) in its indexed documentation, so when a developer runs a search that surfaces those docs the sequences reach the terminal unchanged — forging the displayed hexdocs URL or a suggested command, hiding text, or writing to the clipboard. No authentication or privileged position is required; only publishing a package.
This issue affects usage_rules: from 0.1.18 before 1.2.8.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 14:45 UTC
CWE
- CWE-150 - Improper Neutralization of Escape, Meta, or Control Sequences
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/usage_rules/securi… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82710.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82710 | related |
| https://github.com/ash-project/usage_rules/commit… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | usage_rules |
Affected:
0.1.18 , < 1.2.8
(semver)
cpe:2.3:a:ash-project:usage_rules:*:*:*:*:*:*:*:* |
|
| ash-project | usage_rules |
Affected:
2da7a99536041d63ec1f391d019565789a59595f , < 3b8ebb4117d3272bbd436e6c2432113ba6685dbb
(git)
cpe:2.3:a:ash-project:usage_rules:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82710",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T14:45:15.853850Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T14:45:23.177Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:usage_rules:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Mix.Tasks.UsageRules.SearchDocs\u0027"
],
"packageName": "usage_rules",
"packageURL": "pkg:hex/usage_rules",
"product": "usage_rules",
"programFiles": [
"lib/mix/tasks/usage_rules.search_docs.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Mix.Tasks.UsageRules.SearchDocs\u0027:format_search_result_markdown/4"
}
],
"repo": "https://github.com/ash-project/usage_rules",
"vendor": "ash-project",
"versions": [
{
"lessThan": "1.2.8",
"status": "affected",
"version": "0.1.18",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:usage_rules:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Mix.Tasks.UsageRules.SearchDocs\u0027"
],
"packageName": "ash-project/usage_rules",
"packageURL": "pkg:github/ash-project/usage_rules",
"product": "usage_rules",
"programFiles": [
"lib/mix/tasks/usage_rules.search_docs.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Mix.Tasks.UsageRules.SearchDocs\u0027:format_search_result_markdown/4"
}
],
"repo": "https://github.com/ash-project/usage_rules",
"vendor": "ash-project",
"versions": [
{
"lessThan": "3b8ebb4117d3272bbd436e6c2432113ba6685dbb",
"status": "affected",
"version": "2da7a99536041d63ec1f391d019565789a59595f",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eReachable only when a developer runs \u003ccode\u003emix usage_rules.search_docs\u003c/code\u003e in a terminal emulator that interprets ANSI escape sequences and the results include documentation from an attacker-published package (for example a broad \u003ccode\u003e--everywhere\u003c/code\u003e search).\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Reachable only when a developer runs `mix usage_rules.search_docs` in a terminal emulator that interprets ANSI escape sequences and the results include documentation from an attacker-published package (for example a broad `--everywhere` search)."
}
],
"value": "Reachable only when a developer runs mix usage_rules.search_docs in a terminal emulator that interprets ANSI escape sequences and the results include documentation from an attacker-published package (for example a broad --everywhere search)."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:usage_rules:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.2.8",
"versionStartIncluding": "0.1.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project usage_rules allows a malicious package publisher to inject terminal control sequences into the output of \u003ccode\u003emix usage_rules.search_docs\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003emix usage_rules.search_docs\u003c/code\u003e searches Hex documentation through \u003ccode\u003esearch.hexdocs.pm\u003c/code\u003e, which indexes the documentation of every published package, and prints the matching results (title, package, type, doc reference, and highlighted snippets) to the terminal. The formatter in \u003ccode\u003eMix.Tasks.UsageRules.SearchDocs\u003c/code\u003e interpolated those publisher-controlled fields verbatim, neutralizing no terminal control characters; the only transform it applied adds escape sequences rather than removing them. A malicious package can embed ANSI terminal escape sequences (cursor movement, line erase, carriage returns, OSC 52 clipboard writes) in its indexed documentation, so when a developer runs a search that surfaces those docs the sequences reach the terminal unchanged \u2014 forging the displayed hexdocs URL or a suggested command, hiding text, or writing to the clipboard. No authentication or privileged position is required; only publishing a package.\u003c/p\u003e\n\u003cp\u003eThis issue affects usage_rules: from 0.1.18 before 1.2.8.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project usage_rules allows a malicious package publisher to inject terminal control sequences into the output of `mix usage_rules.search_docs`.\n\n`mix usage_rules.search_docs` searches Hex documentation through `search.hexdocs.pm`, which indexes the documentation of every published package, and prints the matching results (title, package, type, doc reference, and highlighted snippets) to the terminal. The formatter in `Mix.Tasks.UsageRules.SearchDocs` interpolated those publisher-controlled fields verbatim, neutralizing no terminal control characters; the only transform it applied adds escape sequences rather than removing them. A malicious package can embed ANSI terminal escape sequences (cursor movement, line erase, carriage returns, OSC 52 clipboard writes) in its indexed documentation, so when a developer runs a search that surfaces those docs the sequences reach the terminal unchanged \u2014 forging the displayed hexdocs URL or a suggested command, hiding text, or writing to the clipboard. No authentication or privileged position is required; only publishing a package.\n\nThis issue affects usage_rules: from 0.1.18 before 1.2.8."
}
],
"value": "Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project usage_rules allows a malicious package publisher to inject terminal control sequences into the output of mix usage_rules.search_docs.\n\nmix usage_rules.search_docs searches Hex documentation through search.hexdocs.pm, which indexes the documentation of every published package, and prints the matching results (title, package, type, doc reference, and highlighted snippets) to the terminal. The formatter in Mix.Tasks.UsageRules.SearchDocs interpolated those publisher-controlled fields verbatim, neutralizing no terminal control characters; the only transform it applied adds escape sequences rather than removing them. A malicious package can embed ANSI terminal escape sequences (cursor movement, line erase, carriage returns, OSC 52 clipboard writes) in its indexed documentation, so when a developer runs a search that surfaces those docs the sequences reach the terminal unchanged \u2014 forging the displayed hexdocs URL or a suggested command, hiding text, or writing to the clipboard. No authentication or privileged position is required; only publishing a package.\n\nThis issue affects usage_rules: from 0.1.18 before 1.2.8."
}
],
"impacts": [
{
"capecId": "CAPEC-93",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-93 Log Injection-Tampering-Forging"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-150",
"description": "CWE-150 Improper Neutralization of Escape, Meta, or Control Sequences",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T00:23:36.912Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/usage_rules/security/advisories/GHSA-j59f-776f-23hp"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82710.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82710"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/usage_rules/commit/3b8ebb4117d3272bbd436e6c2432113ba6685dbb"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Terminal escape sequence injection in mix usage_rules.search_docs via package documentation metadata"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82710",
"datePublished": "2026-09-08T00:23:36.912Z",
"dateReserved": "2026-09-07T20:30:01.990Z",
"dateUpdated": "2026-09-08T14:45:23.177Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}