CVE-2026-77970
Received Received - Intake

Cleartext Storage of Sensitive Data in ash_paper_trail

Publication date: 2026-08-30

Last updated on: 2026-08-30

Assigner: EEF

Description
Cleartext Storage of Sensitive Information vulnerability in ash-project ash_paper_trail allows an attacker with read access to the generated version resource to recover sensitive values nested inside embedded resources, unions, or lists. sensitive_attributes :redact and :ignore only act on the tracked resource's top-level attributes. maybe_redact_changes/3 and the stored-action-input path in AshPaperTrail.Resource.Changes.CreateNewVersion derive the sensitive set from the resource's own attributes and never descend into embedded, union, or list values, so a non-sensitive attribute or action argument that holds an embed with a sensitive? field (for example an accepted credentials embed carrying a token) is written to the version table in cleartext. This issue affects ash_paper_trail: from 0.3.0 before 0.7.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-30
Last Modified
2026-08-30
Generated
2026-08-30
AI Q&A
2026-08-30
EPSS Evaluated
N/A
NVD
CVE-2026-77970
EUVD
EUVD-2026-68143

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ash-project ash_paper_trail From 0.3.0 (inc) to 0.7.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-312 The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves sensitive information being stored in plaintext within version history in the AshPaperTrail library. The redaction mechanism only applies to top-level attributes, leaving nested sensitive data (like tokens in embedded credentials) exposed in version tables.

Detection Guidance

To detect this vulnerability, inspect your AshPaperTrail version tables for plaintext sensitive data in nested structures. Check columns like changes or version_action_inputs for unredacted secrets in embedded resources, unions, or lists. Use database queries to search for common sensitive patterns (e.g., 'token', 'password', 'secret') in these columns.

Impact Analysis

An attacker with read access to versioned resources could recover sensitive data like tokens or credentials stored in nested structures. This could lead to unauthorized access or data breaches, especially since version tables often have broader access and retention policies.

Compliance Impact

This vulnerability could violate compliance requirements by exposing sensitive data in plaintext, such as tokens or credentials, which are protected under GDPR and HIPAA. Unauthorized disclosure of such data may result in regulatory penalties.

Mitigation Strategies

Immediately update ash_paper_trail to version 0.7.0 or later to apply the recursive redaction fix. Review and redact any sensitive data already stored in version tables. Ensure sensitive_attributes :redact is properly configured for all nested fields.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77970. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart