CVE-2026-70395
Received Received - Intake

Improper Data Query Logic in Ash Framework

Publication date: 2026-08-09

Last updated on: 2026-08-09

Assigner: EEF

Description
Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash allows an attacker to forge a relationship to a record they cannot name, and to recover the secret value used to look it up. When manage_relationship is used with on_lookup: :relate on a belongs_to relationship, the client-supplied lookup value is passed to Ash.Query.filter/2 without being cast to the attribute type. A nested map submitted where a scalar is expected is therefore interpreted as a filter predicate rather than a literal, so a lookup for a specific record becomes a query for any record matching a condition. The same path omits Ash.Query.limit(1), leaving Ash.read_one/2 able to distinguish no match from one match from several, which turns comparison predicates into an oracle for the lookup value. Authorization is unaffected; the destination read policy still applies. This issue affects ash: from 1.52.0-rc.11 before 3.31.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-09
Last Modified
2026-08-09
Generated
2026-08-09
AI Q&A
2026-08-09
EPSS Evaluated
N/A
NVD
CVE-2026-70395
EUVD
EUVD-2026-54939

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ash-project ash From 1.52.0-rc.11 (inc) to 3.31.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-943 The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves improper handling of input in the Ash framework's data query logic. When using manage_relationship with on_lookup: :relate on a belongs_to relationship, an attacker can submit a nested map instead of a scalar value. This causes the lookup to be treated as a filter predicate rather than a literal match, allowing the attacker to recover secret lookup keys by querying for records matching specific conditions.

Detection Guidance

To detect this vulnerability, inspect Elixir applications using the Ash framework versions 1.52.0-rc.11 to 3.31.0. Check for usage of manage_relationship with on_lookup: :relate on belongs_to relationships. Review code for improper handling of nested maps in lookup filters.

Impact Analysis

An attacker could exploit this to recover secret values used in record lookups, such as invite codes or unguessable slugs. This could lead to unauthorized access to sensitive data or functionality, depending on the application's use of these secret keys. The impact varies from negligible to serious based on the sensitivity of exposed keys.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized access to sensitive data through predicate injection in data queries. If secret lookup keys like invite codes or unguessable slugs are exposed, it may lead to unauthorized data disclosure, violating confidentiality requirements under these regulations.

Mitigation Strategies

Upgrade the Ash framework to version 3.31.1 or later. Apply the patch from commit 09f4259 which sanitizes managed relationship lookup filters. Review and update any affected belongs_to relationships using manage_relationship with on_lookup: :relate.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-70395. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart