CVE-2026-81633: CWE-20 Improper Input Validation in ash-project ash_graphql

The vulnerability arises in AshGraphql.Graphql.Resolver.resolve_node/2, which decodes a client-supplied global ID by base64-decoding and splitting on ':', then uses the type segment as a key in a map fetch operation without validation. If the type is a valid atom but not present in the map, Map.fetch! raises a KeyError, aborting the resolver before error handling can occur. This leads to an unhandled exception and may expose a stacktrace. The fix replaces Map.fetch! with Map.fetch/2 and returns an 'Invalid node id' error for unknown types. The affected versions are ash_graphql from 0.27.0 before 1.11.0.

An unauthenticated attacker can cause a denial of service by crashing the relay node query resolver with a crafted global ID. The unhandled exception may also expose stacktrace information, potentially revealing internal implementation details. There is no indication of privilege escalation, data modification, or remote code execution. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, low complexity, no privileges or user interaction required, and limited confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor has described a fix that replaces Map.fetch! with Map.fetch/2 and returns an error for invalid node IDs. Until an official patch or update is available, consider implementing input validation or filtering to block malformed relay node queries that could trigger this issue.