EUVD-2026-68288Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with no auth or user interaction required; impact is low confidentiality only - internal field name disclosure, no integrity or availability effect.
Primary rating from Vendor (EEF).
CVSS VectorVendor: EEF
Lifecycle Timeline
3DescriptionCVE.org
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_graphql allows a remote client to read internal field names that an application configured its error_handler to redact.
In AshGraphql.Errors, each error is passed to the configured error_handler and the returned map is merged with the pre-handler path via Map.put_new(handled, :path, path). Because put_new defers to the handler only when the handler itself set :path, a sanitizing handler that returns a fresh map or deletes :path has that decision reverted. The re-injected path comes from build_error_path/5, which falls back to raw internal Ash attribute and argument names when no field_names mapping is configured. A validation failure on a non-exposed or nested field therefore returns internal names in the GraphQL error path, defeating the application's redaction.
This issue affects ash_graphql: from 1.9.0 before 1.11.0.
AnalysisAI
Internal Ash attribute and argument names leak through GraphQL error responses in ash_graphql 1.9.0 through 1.10.x, bypassing application-configured error handlers intended to redact them. A logic flaw in AshGraphql.Errors causes a sanitizing error_handler's decision to suppress the :path field to be silently overridden, re-injecting raw internal field names via build_error_path/5. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: the application must be running ash_graphql 1.9.0 through 1.10.x; the application must have explicitly configured an error_handler that either returns a fresh map without :path or explicitly deletes :path (i.e., a sanitizing handler - applications with no error_handler or handlers that preserve :path are unaffected by this specific bypass); and the Ash resource must have non-exposed or nested fields with no field_names mapping configured. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N, score 6.9) accurately reflects the attack profile: network-reachable, no authentication required, low confidentiality impact limited to the vulnerable system. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade ash_graphql to version 1.11.0 or later, which removes the Map.put_new calls that override handler-suppressed paths (patch commit 78e90d369f09f44c534816de541e60841066a467, advisory at https://github.com/ash-project/ash_graphql/security/advisories/GHSA-ppr2-g9h8-w7qp). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Ash Graphql
View allAshGraphql's Absinthe complexity calculator undercounts nested Relay connection and keyset pagination queries, allowing
Cross-tenant data disclosure in ash_graphql affects authenticated subscribers in multi-tenant deployments running versio
Relay node query crash in AshGraphql (ash_graphql 0.27.0 through 1.10.x) allows an unauthenticated remote caller to abor
GraphQL subscription payloads carrying unauthorized record data leak to authenticated subscribers in ash_graphql 1.4.0-1
Cross-session record leakage in ash_graphql's subscription batcher allows one subscriber's resolved GraphQL records to b
Same weakness CWE-209 – Error Message Information Leak
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today