Description
Improper Input Validation vulnerability in ash-project ash_graphql allows an unauthenticated client to crash a relay node(id: ...) query with an unhandled KeyError.

AshGraphql.Graphql.Resolver.resolve_node/2 decodes the client-supplied global ID with decode_relay_id/1, which only base64-decodes the string and splits it on : without validating the type segment. The decoded type is passed straight to Map.fetch!(type_to_domain_and_resource_map, type). Because fetch! raises on a missing key, a relay ID whose type segment is a valid atom that is not a relay-exposed type aborts the resolver before its resolve/2 clauses and their rescue handlers run, so the error never becomes a GraphQL error and may expose a stacktrace. Common resource names are easy to guess. The fix uses Map.fetch/2 and returns an Invalid node id error for unknown types.

This issue affects ash_graphql: from 0.27.0 before 1.11.0.
Published: 2026-08-30
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service and Information Disclosure
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is an unhandled KeyError triggered when an unauthenticated client supplies a relay node ID with a type segment that is a valid atom but not a relay‑exposed type. The resolver decodes the ID, fetches the type from a map without validation, and raises, aborting the query before its rescue handlers execute. The failure surfaces as an unhandled crash, which can expose a stack trace to the client. This results in denial of service for legitimate queries and potential leakage of internal implementation details.

Affected Systems

The issue affects the ash‑project ash_graphql library, specifically all releases from 0.27.0 up to and including 1.10.x. Versions before 0.27.0 and 1.11.0 or later are not impacted.

Risk and Exploitability

The CVSS score of 6.9 indicates medium severity. Because the exploitation requires only a crafted GraphQL query, any client with network access can trigger the crash; however, the EPSS score is not available, suggesting low to moderate exploitation probability in the wild. The vulnerability is not listed in the CISA KEV catalog, so no public exploit has been confirmed. Attackers could use the crash to deny service to users or, if a stack trace is leaked, gather information about the application stack. No authentication is required, so the risk applies to all exposed GraphQL endpoints.

Generated by OpenCVE AI on August 30, 2026 at 19:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest ash_graphql release (1.11.0 or later) which replaces Map.fetch! with a safe lookup and returns an Invalid node id error for unknown types.
  • If an upgrade is not immediately possible, restrict unauthenticated access to the GraphQL endpoint using network filtering, rate limiting, or an authentication layer so that only trusted clients can send queries.
  • Continuously monitor application logs for any unhandled KeyError crashes and verify that error handling no longer surfaces stack traces to clients.

Generated by OpenCVE AI on August 30, 2026 at 19:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 31 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 30 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
Description Improper Input Validation vulnerability in ash-project ash_graphql allows an unauthenticated client to crash a relay node(id: ...) query with an unhandled KeyError. AshGraphql.Graphql.Resolver.resolve_node/2 decodes the client-supplied global ID with decode_relay_id/1, which only base64-decodes the string and splits it on : without validating the type segment. The decoded type is passed straight to Map.fetch!(type_to_domain_and_resource_map, type). Because fetch! raises on a missing key, a relay ID whose type segment is a valid atom that is not a relay-exposed type aborts the resolver before its resolve/2 clauses and their rescue handlers run, so the error never becomes a GraphQL error and may expose a stacktrace. Common resource names are easy to guess. The fix uses Map.fetch/2 and returns an Invalid node id error for unknown types. This issue affects ash_graphql: from 0.27.0 before 1.11.0.
Title Unhandled KeyError in AshGraphql relay node resolution crashes queries via an unknown type segment
First Time appeared Ash-project
Ash-project ash Graphql
Weaknesses CWE-20
CPEs cpe:2.3:a:ash-project:ash_graphql:*:*:*:*:*:*:*:*
Vendors & Products Ash-project
Ash-project ash Graphql
References
Metrics cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Ash-project Ash Graphql
cve-icon MITRE

Status: PUBLISHED

Assigner: EEF

Published:

Updated: 2026-08-31T15:56:01.954Z

Reserved: 2026-08-30T17:15:01.281Z

Link: CVE-2026-81633

cve-icon Vulnrichment

Updated: 2026-08-31T15:55:55.925Z

cve-icon NVD

Status : Deferred

Published: 2026-08-30T19:17:29.390

Modified: 2026-09-01T21:15:00.147

Link: CVE-2026-81633

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-31T21:22:35Z

Weaknesses
  • CWE-20

    Improper Input Validation