Description
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_graphql allows a remote client to read internal field names that an application configured its error_handler to redact.

In AshGraphql.Errors, each error is passed to the configured error_handler and the returned map is merged with the pre-handler path via Map.put_new(handled, :path, path). Because put_new defers to the handler only when the handler itself set :path, a sanitizing handler that returns a fresh map or deletes :path has that decision reverted. The re-injected path comes from build_error_path/5, which falls back to raw internal Ash attribute and argument names when no field_names mapping is configured. A validation failure on a non-exposed or nested field therefore returns internal names in the GraphQL error path, defeating the application's redaction.

This issue affects ash_graphql: from 1.9.0 before 1.11.0.
Published: 2026-08-30
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Information Disclosure
Action: Immediate Patch
AI Analysis

Impact

The flaw allows a remote client to query GraphQL fields in a way that triggers validation failures, causing the system to include raw internal field names in the error path. These names are normally removed by a configured error_handler, but the handler’s merge logic inadvertently restores the original path when it deletes or resets the :path key. As a result, unprivileged users can learn internal attribute identifiers that should remain hidden, leaking sensitive implementation details that can aid further attacks. The vulnerability falls under CWE‑209, indicative of error or string handling weakness that exposes confidential data.

Affected Systems

The issue is present in ash-project ash_graphql versions 1.9.0 up to, but not including, 1.11.0. Any instance of this library among deployed applications is affected. The vendor is ash-project, and the product is ash_graphql.

Risk and Exploitability

The CVSS score is 6.9, indicating a moderate risk level. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Explo requires only the ability to send a GraphQL request that triggers a validation error on a non‑exposed or nested field; no privileged access or local execution is necessary. Attackers can remotely read internal field names, thus the potential damage is mainly in confidentiality and ease of exploitation for subsequent attacks.

Generated by OpenCVE AI on August 30, 2026 at 19:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest ash_graphql release (1.11.0 or newer) to fix the redaction bypass flaw.
  • If an upgrade is not immediately possible, modify your error_handler implementation to explicitly remove or overwrite the :path field after handling, ensuring no raw internal names propagate.
  • Configure the application to suppress or limit detailed GraphQL error output for unauthenticated users as a short‑term safeguard.

Generated by OpenCVE AI on August 30, 2026 at 19:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 31 Aug 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 30 Aug 2026 18:45:00 +0000

Type Values Removed Values Added
Description Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_graphql allows a remote client to read internal field names that an application configured its error_handler to redact. In AshGraphql.Errors, each error is passed to the configured error_handler and the returned map is merged with the pre-handler path via Map.put_new(handled, :path, path). Because put_new defers to the handler only when the handler itself set :path, a sanitizing handler that returns a fresh map or deletes :path has that decision reverted. The re-injected path comes from build_error_path/5, which falls back to raw internal Ash attribute and argument names when no field_names mapping is configured. A validation failure on a non-exposed or nested field therefore returns internal names in the GraphQL error path, defeating the application's redaction. This issue affects ash_graphql: from 1.9.0 before 1.11.0.
Title Incomplete redaction re-attaches the original error path in AshGraphql, leaking internal field names
First Time appeared Ash-project
Ash-project ash Graphql
Weaknesses CWE-209
CPEs cpe:2.3:a:ash-project:ash_graphql:*:*:*:*:*:*:*:*
Vendors & Products Ash-project
Ash-project ash Graphql
References
Metrics cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Ash-project Ash Graphql
cve-icon MITRE

Status: PUBLISHED

Assigner: EEF

Published:

Updated: 2026-08-31T15:58:48.218Z

Reserved: 2026-08-30T15:30:02.101Z

Link: CVE-2026-78693

cve-icon Vulnrichment

Updated: 2026-08-31T15:58:41.911Z

cve-icon NVD

Status : Deferred

Published: 2026-08-30T19:17:28.620

Modified: 2026-09-01T21:15:00.147

Link: CVE-2026-78693

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-31T21:22:29Z

Weaknesses
  • CWE-209

    Generation of Error Message Containing Sensitive Information