EUVD-2026-68282Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack requires a specific non-default configuration (AC:H) and local log or error-output access (AV:L); no integrity or availability impact applies.
Primary rating from Vendor (EEF).
CVSS VectorVendor: EEF
Lifecycle Timeline
3DescriptionCVE.org
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ash-project ash_cloak allows anyone with access to logs, error trackers, or crash reports, or anyone who can trigger a validation error, to recover the plaintext of a field the library encrypts.
AshCloak.Transformers.SetUpEncryption removes each cloaked attribute from the action's accept list and adds an action argument that carries the plaintext into the encryption change. That argument is built with sensitive?: attr.sensitive?, inheriting the flag from the source attribute, so a cloaked attribute declared without sensitive? true produces a non-sensitive argument. It is the only place the cleartext value lives, and the one place Ash will not redact: it appears verbatim in inspect(changeset), Ash.Error.Invalid and validation error messages, telemetry, :sys dumps, and error-tracker payloads. The generated encrypted attribute and decrypt calculation are already hardcoded sensitive.
This issue affects ash_cloak: from 0.1.0 before 0.4.0.
AnalysisAI
Plaintext values of encrypted fields in ash_cloak leak verbatim into application logs, error-tracker payloads, changeset inspection output, and telemetry when the source attribute is not explicitly declared sensitive. All ash_cloak versions 0.1.0 through 0.3.x for the Elixir/Ash Framework are affected; a patch is available in 0.4.0. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two conditions must both be met: (1) the target application runs ash_cloak 0.1.0-0.3.x with at least one cloaked attribute that was not explicitly declared with sensitive?: true - this is the library default and therefore expected to be the common case; and (2) the attacker can read application logs, error-tracker payloads (Sentry, AppSignal, Honeybadger, etc.), :sys dumps, or telemetry streams, OR can trigger a validation error involving the cloaked attribute and observe the returned error struct or API error response. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 2.1 (AV:L/AC:L/AT:P/PR:N/UI:N/VC:L) accurately reflects a narrow blast radius: exploitation is local in vector, low in confidentiality impact, and gated on a specific attack condition (AT:P) - the cloaked attribute must lack an explicit sensitive?: true declaration. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade ash_cloak to version 0.4.0 or later; the fix hardcodes sensitive?: true on both generated argument sites in AshCloak.Transformers.SetUpEncryption so Ash unconditionally redacts the plaintext value in all inspection, error, and telemetry contexts. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today