CVE-2026-81322
Received Received - Intake

Sensitive Data Exposure in AshCloak Encryption

Publication date: 2026-08-30

Last updated on: 2026-08-30

Assigner: EEF

Description
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ash-project ash_cloak allows anyone with access to logs, error trackers, or crash reports, or anyone who can trigger a validation error, to recover the plaintext of a field the library encrypts. AshCloak.Transformers.SetUpEncryption removes each cloaked attribute from the action's accept list and adds an action argument that carries the plaintext into the encryption change. That argument is built with sensitive?: attr.sensitive?, inheriting the flag from the source attribute, so a cloaked attribute declared without sensitive? true produces a non-sensitive argument. It is the only place the cleartext value lives, and the one place Ash will not redact: it appears verbatim in inspect(changeset), Ash.Error.Invalid and validation error messages, telemetry, :sys dumps, and error-tracker payloads. The generated encrypted attribute and decrypt calculation are already hardcoded sensitive. This issue affects ash_cloak: from 0.1.0 before 0.4.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-30
Last Modified
2026-08-30
Generated
2026-08-30
AI Q&A
2026-08-30
EPSS Evaluated
N/A
NVD
CVE-2026-81322
EUVD
EUVD-2026-68282

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ash-project ash_cloak From 0.1.0 (inc) to 0.4.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in ash_cloak allows unauthorized actors with access to logs, error trackers, crash reports, or validation errors to recover plaintext of encrypted fields. The issue occurs because the plaintext encryption argument is not consistently marked as sensitive, causing it to leak in changeset inspections, errors, or logs.

Detection Guidance

Check AshCloak logs, error trackers, crash reports, or validation errors for plaintext values of encrypted fields. Look for action arguments containing sensitive data that should be redacted. Verify if cloaked attributes are declared without sensitive? true.

Impact Analysis

Attackers can recover sensitive data like passwords or personal information by accessing logs, error messages, or validation failures. This requires local access or log exposure but can lead to data breaches or compliance violations if exploited.

Compliance Impact

This vulnerability could lead to unauthorized exposure of sensitive data, violating GDPR's data protection principles or HIPAA's confidentiality requirements. Organizations using affected versions may face compliance penalties due to potential data leaks.

Mitigation Strategies

Upgrade ash_cloak to version 0.4.0 or later. Ensure all cloaked attributes are explicitly marked as sensitive. Review logs and error outputs for exposed plaintext values.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81322. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart