ash_graphql CVE-2026-78693

Exploitation requires three concurrent conditions: the application must be running ash_graphql 1.9.0 through 1.10.x; the application must have explicitly configured an error_handler that either returns a fresh map without :path or explicitly deletes :path (i.e., a sanitizing handler - applications with no error_handler or handlers that preserve :path are unaffected by this specific bypass); and the Ash resource must have non-exposed or nested fields with no field_names mapping configured. No authentication is required (CVSS PR:N), and no special network position is needed beyond the ability to send GraphQL requests. The limiting factor is that only applications that actively attempted to redact error paths are affected - deployments without a sanitizing error_handler have no security expectation defeated by this CVE.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N, score 6.9) accurately reflects the attack profile: network-reachable, no authentication required, low confidentiality impact limited to the vulnerable system. The real-world risk is contextually elevated for applications that deliberately configured error redaction as a security boundary - for those, the bypass is a complete failure of a configured security control. For applications that never set up a sanitizing error_handler, internal field names were already exposed, so this CVE introduces no marginal risk. There is no KEV listing and no public exploit identified, and the impact is restricted to information disclosure (internal schema reconnaissance) rather than data exfiltration, code execution, or availability impact. EPSS data is not provided; given the niche ecosystem and limited impact class, real-world exploitation probability is likely low.

An attacker sends a GraphQL mutation or query with intentionally invalid input targeting a field that maps to a non-exposed or nested Ash attribute. When validation fails, the application's sanitizing error_handler drops :path from the error map, but AshGraphql re-injects the raw internal attribute name via Map.put_new before returning the response. The attacker reads the path array in the GraphQL error response and discovers internal Ash resource attribute and argument names that the application's security policy intended to conceal, enabling further schema reconnaissance.