CVE-2026-81636 is a high-severity vulnerability in ash-project's ash_graphql component that allows unauthenticated clients to bypass GraphQL query complexity limits. This flaw arises because the query complexity calculation does not properly account for Relay connection pagination parameters (first and last), enabling unbounded database reads. The issue affects versions from 0.16.23 up to but not including 1.11.0. No official patch or remediation guidance is currently confirmed.
CVE-2026-81633 is an improper input validation vulnerability in ash-project's ash_graphql component. An unauthenticated client can send a specially crafted relay node query that triggers an unhandled KeyError, causing the resolver to crash and potentially exposing a stacktrace. This occurs because the type segment of a decoded global ID is not validated before being used as a key in a map fetch operation. The issue affects versions from 0.27.0 up to but not including 1.11.0.
CVE-2026-81643 is an incorrect authorization vulnerability in the ash-project's ash_graphql component. It causes GraphQL subscription payloads to include records that subscribers are not authorized to see due to improper filtering of batched notifications. The issue affects versions from 1.4.0 up to but not including 1.11.0.
Exposure of Data Element to Wrong Session vulnerability in ash-project ash_graphql can deliver one subscription's resolved records to a different subscriber's topic.
AshGraphql.Subscription.Batcher.do_send/5 reads the resolved batch from the process dictionary via Process.get(:batch_resolved) and then unconditionally deletes it. That is sound only inside a task the library owns. On the :backpressure_sync and :noproc fallbacks do_send/5 runs inline in the publishing caller's process, so if a resolver inside an outer do_send/5 triggers another synchronous Ash notification, the inner call finds the outer run's value still under :batch_resolved, adopts it as its own result, and publishes it to the inner topic, a different subscription document with a different actor and tenant. It then deletes the key, so the outer run publishes nothing. The key is not namespaced by run, so records cannot be told apart. The fix saves, clears, and restores :batch_resolved around each run.
This issue affects ash_graphql: from 1.4.0 before 1.11.0.
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ash-project ash_cloak allows anyone with access to logs, error trackers, or crash reports, or anyone who can trigger a validation error, to recover the plaintext of a field the library encrypts.
AshCloak.Transformers.SetUpEncryption removes each cloaked attribute from the action's accept list and adds an action argument that carries the plaintext into the encryption change. That argument is built with sensitive?: attr.sensitive?, inheriting the flag from the source attribute, so a cloaked attribute declared without sensitive? true produces a non-sensitive argument. It is the only place the cleartext value lives, and the one place Ash will not redact: it appears verbatim in inspect(changeset), Ash.Error.Invalid and validation error messages, telemetry, :sys dumps, and error-tracker payloads. The generated encrypted attribute and decrypt calculation are already hardcoded sensitive.
This issue affects ash_cloak: from 0.1.0 before 0.4.0.
Deserialization of Untrusted Data vulnerability in ash-project ash_cloak allows an attacker who can influence the bytes of an encrypted column to crash the BEAM node, by triggering unbounded atom creation or a decompression bomb during decryption.
AshCloak.Calculations.Decrypt decodes the decrypted binary with Ash.Helpers.non_executable_binary_to_term/1 without the :safe option, so atoms in the payload are interned during the decode and never garbage collected, and the term format's compressed form is inflated transparently. vault.decrypt!() is the only barrier and stops tampering only for an authenticated cipher. Cloak also ships the unauthenticated AES.CTR, whose ciphertext an attacker who knows their own plaintext can XOR into any same-length payload without the key, so an ordinary read of the forged column reaches the decoder. A few hundred kilobytes of distinct atoms exhausts the atom table, or a small compressed payload inflates to gigabytes.
This issue affects ash_cloak: from 0.1.0 before 0.4.0.
Unchecked Return Value vulnerability in ash-project ash_postgres allows a user who can drive a tenant rename to a name that collides with an existing tenant's schema to have their tenant record repointed at that other tenant's live schema, gaining access to its data.
AshPostgres.MultiTenancy.rename_tenant/3 issues the ALTER SCHEMA ... RENAME TO ... with the non-raising Ecto.Adapters.SQL.query/2, discards its {:ok, _} | {:error, _} result, and unconditionally returns :ok. PostgreSQL rejects the rename when the target schema already exists (and on insufficient privilege or lock timeout), but that failure never reaches the caller. The calling manage_tenant update action therefore sees success and commits the tenant row with the new name, which is the schema of a different existing tenant, so subsequent reads and writes for that tenant run against the other tenant's data.
This issue affects ash_postgres: from 0.25.0 before 2.13.0.
CVE-2026-77454 is an incorrect authorization vulnerability in the ash-project's ash_sql library. It allows bypassing of authorization filters when a relationship declares both a limit (or from_many?) and a parent-referencing filter or sort. This causes the authorization check to be skipped, potentially allowing unauthorized access. The issue affects versions from 0.4.1 up to but not including 0.7.1.
CVE-2026-81316 is an incorrect authorization vulnerability in ash-project's ash_sql component. It allows an attacker to receive aggregate values computed over data that should have been excluded by more restrictive filters, potentially disclosing sensitive aggregated information across authorization or tenancy boundaries. The issue arises because aggregate queries are considered identical if their filters differ but their sort criteria do not, leading to reuse of aggregate results from broader queries for narrower ones. This affects ash_sql versions from 0.1.0 up to but not including 0.7.1.
CVE-2026-81318 is an incorrect authorization vulnerability in ash-project's ash_sql library affecting versions from 0.1.0 up to but not including 0.7.1. The flaw allows a caller in a schema-based multitenant application to receive aggregate values computed from another tenant's data due to improper query rebuilding that loses tenant schema context. This results in aggregates being computed against the wrong tenant's rows. The vulnerability has a low severity score and no known exploits or official patches at this time.
CVE-2026-78691 is a vulnerability in ash-project's ash_sql component where improper neutralization of special elements in SQL LIKE query logic allows an attacker to inject live SQL LIKE wildcards. This occurs because the escaping mechanism does not properly escape backslashes, enabling attackers to manipulate pattern matching. The vulnerability affects versions from 0.1.1-rc.10 before 0.7.1 of ash_sql. The CVSS score is low, indicating limited impact.
CVE-2026-80227 is an incorrect comparison vulnerability in ash-project's ash_sql component. It arises because the string_trim/1 function compiles to SQL that only removes literal spaces, unlike Elixir's String.trim/1 which removes all whitespace characters including tabs, newlines, carriage returns, and form feeds. This discrepancy allows padded strings with certain whitespace characters to pass trimmed uniqueness or equality checks in the database but fail in memory, or vice versa. This can cause near-duplicate values or bypass trimmed comparisons in filters, validations, or identities relying on string_trim/1.
CVE-2026-78228 is an uncontrolled recursion vulnerability in the ash-project's ash_oban component. It occurs when a user's on_error trigger action fails on the final job attempt, causing infinite recursion that exhausts CPU and memory, leading to denial of service. The issue affects versions from 0.8.0-rc.1 up to but not including 0.8.14. The vulnerability results from a recursive call to handle_error/4 that is not in tail position, causing unbounded memory growth and eventual worker process termination.
CVE-2026-78038 is a medium severity vulnerability in ash-project's ash_oban component that allows improper modification of dynamically-determined object attributes. The flaw arises because user input passed to the :args option of AshOban.build_trigger/3 can override trusted job arguments due to JSON key handling, enabling an attacker to retarget update or destroy triggers at other records, potentially crossing tenant boundaries. This breaks authorization and tenant isolation assumptions. The vulnerability affects versions from 0.2.5 up to but not including 0.8.14.
CVE-2026-77846 is a low-severity vulnerability in ash-project's ash_sqlite component that allows attackers controlling a get_path/2 segment to access nested JSON fields not intended for exposure. This occurs due to improper neutralization of special elements in JSON path query logic, enabling traversal into deeper JSON structures. The vulnerability affects versions from 0.1.2-rc.0 up to but not including 0.2.18. No official patch or remediation guidance is currently available.
CVE-2026-77831 is an inefficient algorithmic complexity vulnerability in the ash-project's ash_paper_trail library. It allows a user who can submit a large array attribute during a paper-trailed create or update action to cause a denial of service by consuming excessive CPU and memory resources. The vulnerability arises from the way the library pairs prior array elements with new ones, resulting in cubic scaling of resource use relative to the array length. This affects versions from 0.1.1 up to but not including 0.7.0.
CVE-2026-77970 is a medium severity vulnerability in ash-project's ash_paper_trail component that causes cleartext storage of sensitive information. The vulnerability arises because sensitive attributes are only redacted at the top-level resource, while embedded, union, or list values containing sensitive data are stored in cleartext in the version table. This affects versions from 0.3.0 up to but not including 0.7.0. No official patch or remediation guidance is currently available.
CVE-2026-75847 is a medium severity vulnerability in ash-project's ash_paper_trail component that causes sensitive attribute values to be stored in cleartext within the generated version resource. This occurs because the changes map storing these values is marked as not sensitive, leading to exposure in default read actions, logs, and error messages. The issue affects versions from 0.1.1 up to but not including 0.7.0.
Deserialization of Untrusted Data vulnerability in ash-project ash allows an unauthenticated attacker to inject a filter expression through a forged keyset pagination cursor, resulting in SQL injection or code execution depending on the data layer.
Read actions with keyset pagination decode the client-supplied page[:after] or page[:before] cursor in decode_values/2 in lib/ash/page/keyset.ex using non_executable_binary_to_term/2 with [:safe]. That guard blocks new atoms, funs, and ports, but not a struct built from atoms already interned in a running Ash application, so a decoded %Ash.Query.Call{} expression survives and is spliced into the keyset filter as a comparison value in do_filters/4 and evaluated. Because the cursor bypasses the Ash.Expr macro, the runtime never applies the private?/public? gate that would otherwise reject it. On AshPostgres the injected fragment is inlined into the SQL query; on the ETS and Simple data layers it is evaluated in-process as an arbitrary function call.
This issue affects ash: from 1.17.0 before 3.31.3.
CVE-2026-70395 is a low severity vulnerability in ash-project ash that allows an attacker to manipulate data query logic by submitting specially crafted lookup values. This improper neutralization of special elements in data query logic can enable an attacker to forge relationships to records they cannot name and recover secret lookup values. The issue arises when the manage_relationship function uses on_lookup: :relate on a belongs_to relationship, passing client-supplied lookup values to Ash.Query.filter/2 without proper type casting. Authorization policies remain enforced, limiting unauthorized data access.