CVE-2026-78693: CWE-209 Generation of Error Message Containing Sensitive Information in ash-project ash_graphql

The vulnerability arises in ash_graphql's error handling where each error is passed to a configured error_handler, which returns a map merged with the pre-handler path using Map.put_new. If the handler returns a fresh map or deletes the :path key, the original internal path is re-injected from build_error_path/5. This fallback uses raw internal Ash attribute and argument names when no field_names mapping is set, causing validation failures on non-exposed or nested fields to reveal internal names in GraphQL error paths. This defeats the application's intended redaction of sensitive information.

Remote clients can obtain internal field names that the application intended to redact in error messages. This exposure of sensitive internal information can aid attackers in understanding the internal structure of the application, potentially facilitating further attacks or information gathering. There is no indication of privilege requirements or user interaction needed, and the vulnerability is exploitable remotely.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should review their error_handler configurations and consider implementing explicit field name mappings to avoid fallback to internal names. Monitoring vendor communications for updates is recommended.