CVE-2026-77970: CWE-312 Cleartext Storage of Sensitive Information in ash-project ash_paper_trail

The vulnerability CVE-2026-77970 in ash-project's ash_paper_trail allows an attacker with read access to the generated version resource to recover sensitive values stored in cleartext. The issue stems from the fact that the :redact and :ignore options only apply to top-level attributes of the tracked resource. The mechanisms that derive sensitive attributes for redaction do not descend into embedded, union, or list values. Consequently, sensitive data nested inside these structures, such as tokens within embedded credentials, are written to the version table without encryption or redaction. This affects versions starting at 0.3.0 and prior to 0.7.0.

An attacker with read access to the version resource can obtain sensitive information that should have been protected, potentially exposing credentials or tokens stored within embedded or nested data structures. This cleartext exposure increases the risk of unauthorized data disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict read access to the version resource to trusted users only and review usage of embedded sensitive data in tracked resources to minimize exposure.