CVE-2026-81633: Improper Input Validation

Improper Input Validation vulnerability in ash-project ashgraphql allows an unauthenticated client to crash a relay nodeid: ... query with an unhandled KeyError. AshGraphql.Graphql.Resolver.resolvenode/2 decodes the client-supplied global ID with decoderelayid/1, which only base64-decodes the...

CVE-2026-78693: Generation of Error Message Containing Sensitive Information

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashgraphql allows a remote client to read internal field names that an application configured its errorhandler to redact. In AshGraphql.Errors, each error is passed to the configured errorhandler and the...

CVE-2026-81643: Incorrect Authorization

Incorrect Authorization vulnerability in ash-project ashgraphql delivers GraphQL subscription payloads for records a subscriber is not authorized to see. In AshGraphql.Subscription.Batcher, dosend/5 resolves the first notification of a batch and filters it with shouldsend?/1, which drops results...

CVE-2026-81319: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in ash-project ashcloak allows an attacker who can influence the bytes of an encrypted column to crash the BEAM node, by triggering unbounded atom creation or a decompression bomb during decryption. AshCloak.Calculations.Decrypt decodes the decrypte...

CVE-2026-78699: Unchecked Return Value

Unchecked Return Value vulnerability in ash-project ashpostgres allows a user who can drive a tenant rename to a name that collides with an existing tenant's schema to have their tenant record repointed at that other tenant's live schema, gaining access to its data...

CVE-2026-75847: Cleartext Storage of Sensitive Information

Cleartext Storage of Sensitive Information vulnerability in ash-project ashpapertrail allows an attacker with read access to the generated version resource to recover the plaintext of sensitive? attributes. AshPaperTrail stores the values of tracked sensitive? attributes in the generated version...

CVE-2026-77831: Inefficient Algorithmic Complexity

Inefficient Algorithmic Complexity vulnerability in ash-project ashpapertrail allows a user who can submit a large array attribute to a paper-trailed create or update action to cause a denial of service through excessive CPU and memory use. With full-diff change tracking,...

CVE-2026-67579

Deserialization of Untrusted Data vulnerability in ash-project ash allows an unauthenticated attacker to inject a filter expression through a forged keyset pagination cursor, resulting in SQL injection or code execution depending on the data layer. Read actions with keyset pagination decode the...

CVE-2026-67579 Filter expression injection via forged keyset pagination cursor in Ash

Deserialization of Untrusted Data vulnerability in ash-project ash allows an unauthenticated attacker to inject a filter expression through a forged keyset pagination cursor, resulting in SQL injection or code execution depending on the data layer. Read actions with keyset pagination decode the...

EUVD-2026-57544

Deserialization of Untrusted Data vulnerability in ash-project ash allows an unauthenticated attacker to inject a filter expression through a forged keyset pagination cursor, resulting in SQL injection or code execution depending on the data layer. Read actions with keyset pagination decode the...

CVE-2026-70395

Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash allows an attacker to forge a relationship to a record they cannot name, and to recover the secret value used to look it up. When managerelationship is used with onlookup: :relate on a belongsto...

CVE-2026-70395

Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash allows an attacker to forge a relationship to a record they cannot name, and to recover the secret value used to look it up. When managerelationship is used with onlookup: :relate on a belongsto...

CVE-2026-70395

The CVE-2026-70395 description identifies a vulnerability in ash-project where, for belongs_to relationships using on_lookup: :relate, a client-provided lookup value is passed to Ash.Query.filter/2 without type casting. This can cause a nested map to be treated as a filter predicate rather than a...

EUVD-2026-54939

Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash allows an attacker to forge a relationship to a record they cannot name, and to recover the secret value used to look it up. When managerelationship is used with onlookup: :relate on a belongsto...

CVE-2026-69659

Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to exhaust the memory of the node via a crafted keyset pagination cursor. Read actions with keyset pagination deserialize the client-supplied page:after or page:before cursor in decodevalues/2 in...

CVE-2026-69659

Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to exhaust the memory of the node via a crafted keyset pagination cursor. Read actions with keyset pagination deserialize the client-supplied page:after or page:before cursor in decodevalues/2 in...

EUVD-2026-54937

Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to exhaust the memory of the node via a crafted keyset pagination cursor. Read actions with keyset pagination deserialize the client-supplied page:after or page:before cursor in decodevalues/2 in...

CVE-2026-69659

CVE-2026-69659 affects ash-project Ash, specifically the keyset pagination cursor handling in Ash.Page.Keyset. Read actions using keyset pagination deserialize client-supplied page[:after] or page[:before] by base64 decoding the cursor and passing it to Erlang :erlang.binary_to_term/2 without siz...

CVE-2026-69659 Memory exhaustion via unbounded deserialization of keyset pagination cursors in Ash.Page.Keyset

Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to exhaust the memory of the node via a crafted keyset pagination cursor. Read actions with keyset pagination deserialize the client-supplied page:after or page:before cursor in decodevalues/2 in...

CVE-2026-70395: Improper Neutralization of Special Elements in Data Query Logic

Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash allows an attacker to forge a relationship to a record they cannot name, and to recover the secret value used to look it up. When managerelationship is used with onlookup: :relate on a belongsto...