CVE-2026-78693
Received Received - Intake

Information Disclosure in AshGraphQL via Error Path

Publication date: 2026-08-30

Last updated on: 2026-08-30

Assigner: EEF

Description
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_graphql allows a remote client to read internal field names that an application configured its error_handler to redact. In AshGraphql.Errors, each error is passed to the configured error_handler and the returned map is merged with the pre-handler path via Map.put_new(handled, :path, path). Because put_new defers to the handler only when the handler itself set :path, a sanitizing handler that returns a fresh map or deletes :path has that decision reverted. The re-injected path comes from build_error_path/5, which falls back to raw internal Ash attribute and argument names when no field_names mapping is configured. A validation failure on a non-exposed or nested field therefore returns internal names in the GraphQL error path, defeating the application's redaction. This issue affects ash_graphql: from 1.9.0 before 1.11.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-30
Last Modified
2026-08-30
Generated
2026-08-31
AI Q&A
2026-08-30
EPSS Evaluated
N/A
NVD
CVE-2026-78693
EUVD
EUVD-2026-68288

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ash-project ash_graphql From 1.9.0 (inc) to 1.11.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-209 The product generates an error message that includes sensitive information about its environment, users, or associated data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in ash_graphql allows a remote client to read internal field names that an application configured its error_handler to redact. When an error occurs, the error_handler processes it to sanitize sensitive data, but AshGraphql reattaches the original error path afterward, undoing the redaction. This exposes internal attribute and argument names in GraphQL error messages.

Detection Guidance

To detect this vulnerability, check if your system uses ash_graphql versions between 1.9.0 and 1.11.0. Run: gem list ash_graphql or mix deps to verify installed versions. Inspect GraphQL error responses for internal field names like internalOwnerSecretId in validation failures.

Impact Analysis

An attacker could exploit this by submitting a failing GraphQL request, such as a mutation with invalid nested input, to leak sensitive internal field names. This results in information disclosure, exposing details like internalOwnerSecretId that should remain hidden. The vulnerability requires no special privileges or user interaction and can be exploited remotely.

Compliance Impact

This vulnerability could violate compliance requirements like GDPR or HIPAA by exposing sensitive internal data through error messages. GDPR requires protecting personal data, while HIPAA mandates safeguarding protected health information. Leaking internal field names may indicate insufficient data protection measures.

Mitigation Strategies

Upgrade ash_graphql to version 1.11.0 or later immediately. If upgrading is not possible, review and modify error handlers to ensure they explicitly handle the :path key to prevent reattachment. Test error responses to confirm internal fields are not exposed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78693. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart