CVE-2026-81633
Received Received - Intake

Improper Input Validation in ash_graphql GraphQL Resolver

Publication date: 2026-08-30

Last updated on: 2026-08-30

Assigner: EEF

Description
Improper Input Validation vulnerability in ash-project ash_graphql allows an unauthenticated client to crash a relay node(id: ...) query with an unhandled KeyError. AshGraphql.Graphql.Resolver.resolve_node/2 decodes the client-supplied global ID with decode_relay_id/1, which only base64-decodes the string and splits it on : without validating the type segment. The decoded type is passed straight to Map.fetch!(type_to_domain_and_resource_map, type). Because fetch! raises on a missing key, a relay ID whose type segment is a valid atom that is not a relay-exposed type aborts the resolver before its resolve/2 clauses and their rescue handlers run, so the error never becomes a GraphQL error and may expose a stacktrace. Common resource names are easy to guess. The fix uses Map.fetch/2 and returns an Invalid node id error for unknown types. This issue affects ash_graphql: from 0.27.0 before 1.11.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-30
Last Modified
2026-08-30
Generated
2026-08-31
AI Q&A
2026-08-30
EPSS Evaluated
N/A
NVD
CVE-2026-81633
EUVD
EUVD-2026-68285

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ash-project ash_graphql From 0.27.0 (inc) to 1.11.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Improper Input Validation issue in the ash_graphql library, part of the Ash framework for Elixir. It allows an unauthenticated attacker to crash a GraphQL node resolution query by providing a malformed relay ID. The resolver function decodes the ID without validating the type segment, causing a KeyError if the type is unknown. This leads to a server crash instead of returning a proper GraphQL error.

Detection Guidance

To detect this vulnerability, monitor for crashes or stack traces in GraphQL resolvers when processing relay node queries. Check logs for KeyError exceptions in AshGraphql.Graphql.Resolver.resolve_node/2. Verify if your ash_graphql version is between 0.27.0 and 1.10.1.

Impact Analysis

An attacker could exploit this to crash the GraphQL server, potentially causing downtime or exposing stack traces that reveal internal system details. This may lead to information disclosure or denial of service. The attack requires no authentication and can be performed remotely.

Compliance Impact

This vulnerability may impact compliance with GDPR and HIPAA by potentially exposing stack traces or error details that could reveal system information, violating data protection principles. Unhandled errors could lead to unauthorized information disclosure, which conflicts with GDPR's data minimization and security requirements and HIPAA's safeguards for protected health information.

Mitigation Strategies

Upgrade ash_graphql to version 1.11.0 or later. If upgrading is not immediately possible, implement input validation for relay IDs before they reach the resolver. Ensure error handling captures and logs KeyError exceptions gracefully.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81633. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart