CVE-2026-82367
Received Received - Intake

Session Data Exposure in AshGraphQL Subscription Batcher

Publication date: 2026-08-30

Last updated on: 2026-08-30

Assigner: EEF

Description
Exposure of Data Element to Wrong Session vulnerability in ash-project ash_graphql can deliver one subscription's resolved records to a different subscriber's topic. AshGraphql.Subscription.Batcher.do_send/5 reads the resolved batch from the process dictionary via Process.get(:batch_resolved) and then unconditionally deletes it. That is sound only inside a task the library owns. On the :backpressure_sync and :noproc fallbacks do_send/5 runs inline in the publishing caller's process, so if a resolver inside an outer do_send/5 triggers another synchronous Ash notification, the inner call finds the outer run's value still under :batch_resolved, adopts it as its own result, and publishes it to the inner topic, a different subscription document with a different actor and tenant. It then deletes the key, so the outer run publishes nothing. The key is not namespaced by run, so records cannot be told apart. The fix saves, clears, and restores :batch_resolved around each run. This issue affects ash_graphql: from 1.4.0 before 1.11.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-30
Last Modified
2026-08-30
Generated
2026-08-31
AI Q&A
2026-08-30
EPSS Evaluated
N/A
NVD
CVE-2026-82367
EUVD
EUVD-2026-68283

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ash-project ash_graphql From 1.4.0 (inc) to 1.10.1 (exc)
ash-project ash_graphql From 1.4.0 (inc) to 1.11.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-488 The product does not sufficiently enforce boundaries between the states of different sessions, causing data to be provided to, or used by, the wrong session.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a re-entrant synchronous publish issue in the ash_graphql library. When a resolver triggers another synchronous Ash notification during an outer publication, the inner call incorrectly adopts the outer process's resolved records from the :batch_resolved key. This causes one subscriber's records to be delivered to a different subscriber's topic, leading to cross-contamination of subscription results.

Detection Guidance

This vulnerability is specific to applications using ash_graphql versions 1.4.0 to before 1.11.0 with subscriptions enabled. Detection requires checking the ash_graphql version in your application dependencies. Use commands like 'mix deps' in Elixir or inspecting package.json for JavaScript/Node.js environments. If using a package manager, run 'npm list ash_graphql' or 'mix deps.tree' to verify versions.

Impact Analysis

The impact includes unauthorized data exposure where records from one subscription may be sent to a different subscriber's topic. This could lead to information leaks across actor or tenant boundaries. Additionally, the original batch may be dropped, causing message loss for the intended recipient.

Compliance Impact

This vulnerability could lead to unauthorized data exposure by delivering one subscriber's records to another subscriber's topic, potentially violating data segregation requirements in GDPR and HIPAA. The cross-contamination of subscription results may result in unauthorized access to sensitive data across actor or tenant boundaries, which is a compliance violation for regulations requiring strict data access controls.

Mitigation Strategies

Upgrade ash_graphql to version 1.11.0 or later immediately. If upgrading is not possible, disable subscriptions in ash_graphql or avoid using synchronous resolvers that trigger nested Ash notifications. Review subscription configurations to ensure no sensitive data is exposed across topics.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82367. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart