CVE-2026-86338

Ash fieldpolicies are documented to protect against filter-based information disclosure: when a field the actor may not see is referenced in a filter, it is replaced with an expression that evaluates to nil, so a filter cannot be used as a yes/no oracle to read a value the actor cannot see. This...

PT-2026-93377

Name of the Vulnerable Software and Affected Versions ash versions 2.11.0-rc.0 through 3.33.3 Description Field policies are intended to prevent information disclosure by replacing fields an actor cannot see with a nil expression when used in a filter, preventing the filter from acting as a yes/n...