CVE-2026-78038
Received Received - Intake

Privilege Escalation in ash_oban via Trigger Manipulation

Publication date: 2026-08-30

Last updated on: 2026-08-30

Assigner: EEF

Description
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash_oban allows a user whose input reaches the :args option of AshOban.build_trigger/3 to retarget an update or destroy trigger at another record, including across tenants. build_trigger/3 builds the trusted job arguments with atom keys (:primary_key, :tenant, :action_arguments) and merges the caller's :args underneath so the trusted values win on collision. Because Oban job arguments round-trip through JSON, the caller's keys arrive as strings, so Map.merge sees no collision and both keys survive. When the job is persisted the JSON object is de-duplicated keeping the last (string) key, and the worker reads the caller's value. The documentation describes :args as unable to affect the action, so an application that forwards user input into it for uniqueness scoping is exposed to authorization bypass and tenant isolation breaks. This issue affects ash_oban: from 0.2.5 before 0.8.14.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-30
Last Modified
2026-08-30
Generated
2026-08-30
AI Q&A
2026-08-30
EPSS Evaluated
N/A
NVD
CVE-2026-78038
EUVD
EUVD-2026-68185

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ash-project ash_oban From 0.2.5 (inc) to 0.8.14 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-915 The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in ash_oban allows user input in the :args option of AshOban.build_trigger/3 to override reserved keys like primary_key, tenant, and action_arguments. Due to JSON round-tripping, string keys from user input take precedence over system-generated atom keys, enabling cross-tenant record retargeting and authorization bypass.

Detection Guidance

To detect this vulnerability, check if your system uses ash_oban versions between 0.2.5 and 0.8.13. Run: grep -r "ash_oban" mix.lock or mix.exs in your project directory. If vulnerable, update to version 0.8.14 or later.

Impact Analysis

An attacker could manipulate job arguments to redirect operations to unintended records or tenants, bypassing authorization controls and tenant isolation. This could lead to unauthorized data access, modification, or deletion across tenant boundaries in affected applications.

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized data access or modification across tenant boundaries. It may lead to breaches of data isolation principles required by GDPR and HIPAA, potentially resulting in regulatory penalties and loss of trust.

Mitigation Strategies

Immediately upgrade ash_oban to version 0.8.14 or later to address the vulnerability. Review any code that passes user input into the :args parameter of AshOban.build_trigger/3 and remove such usage to prevent potential authorization bypass or tenant isolation breaks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78038. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart