EUVD-2026-68285Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network-reachable GraphQL endpoint; C:L for stacktrace disclosure, A:L for relay resolver crash degrading that query handler.
Primary rating from Vendor (EEF).
CVSS VectorVendor: EEF
Lifecycle Timeline
3DescriptionCVE.org
Improper Input Validation vulnerability in ash-project ash_graphql allows an unauthenticated client to crash a relay node(id: ...) query with an unhandled KeyError.
AshGraphql.Graphql.Resolver.resolve_node/2 decodes the client-supplied global ID with decode_relay_id/1, which only base64-decodes the string and splits it on : without validating the type segment. The decoded type is passed straight to Map.fetch!(type_to_domain_and_resource_map, type). Because fetch! raises on a missing key, a relay ID whose type segment is a valid atom that is not a relay-exposed type aborts the resolver before its resolve/2 clauses and their rescue handlers run, so the error never becomes a GraphQL error and may expose a stacktrace. Common resource names are easy to guess. The fix uses Map.fetch/2 and returns an Invalid node id error for unknown types.
This issue affects ash_graphql: from 0.27.0 before 1.11.0.
AnalysisAI
Relay node query crash in AshGraphql (ash_graphql 0.27.0 through 1.10.x) allows an unauthenticated remote caller to abort the Absinthe node(id:...) resolver by supplying a base64-encoded relay ID whose type segment resolves to an existing BEAM VM atom that is not a registered relay resource type. Because the resolver calls Map.fetch!/2 before Absinthe's rescue handlers run, the resulting KeyError surfaces as an unhandled process exception rather than a structured GraphQL error, potentially leaking an internal stacktrace with module names and file paths. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target application must run AshGraphql versions 0.27.0 through 1.10.x with the Absinthe relay node(id:...) query exposed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The assigned CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N) scores 6.9, confirming unauthenticated network exploitability with low confidentiality impact from stacktrace disclosure. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade ash_graphql to version 1.11.0 or later, which replaces the unsafe Map.fetch!/2 call with Map.fetch/2 and properly returns a structured 'Invalid node id' GraphQL error for unknown relay types (patch commit: https://github.com/ash-project/ash_graphql/commit/c8863ed8e5c21f1bfb6125f1d24e78443dfc6351; advisory: https://github.com/ash-project/ash_graphql/security/advisories/GHSA-mrgv-g7gf-r96h). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Ash Graphql
View allAshGraphql's Absinthe complexity calculator undercounts nested Relay connection and keyset pagination queries, allowing
Cross-tenant data disclosure in ash_graphql affects authenticated subscribers in multi-tenant deployments running versio
Internal Ash attribute and argument names leak through GraphQL error responses in ash_graphql 1.9.0 through 1.10.x, bypa
GraphQL subscription payloads carrying unauthorized record data leak to authenticated subscribers in ash_graphql 1.4.0-1
Cross-session record leakage in ash_graphql's subscription batcher allows one subscriber's resolved GraphQL records to b
Same weakness CWE-20 – Improper Input Validation
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today