Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2026-78693: AshGraphQL may reveal hidden field names in error messages
CVE-2026-78693 · published 4 days ago
Summary
Software that uses AshGraphQL can unintentionally include the names of hidden data fields in the error messages it sends back to users. This happens in versions from 1.9.0 up to but not including 1.11.0, even when the application tries to hide those names. Upgrade to version 1.11.0 or later (or apply the provided patch) to stop the leakage.
What to do
- Update ash_graphql to version 1.11.0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | ash-project | ash_graphql |
< 1.11.0 < 78e90d369f09f44c534816de541e60841066a467 |
| Hex | – | ash_graphql |
>= 1.9.0, < 1.11.0 Fix: upgrade to 1.11.0
|
Original advisory text
Incomplete redaction re-attaches the original error path in AshGraphql, leaking internal field names
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_graphql allows a remote client to read internal field names that an application configured its error_handler to redact.
In AshGraphql.Errors, each error is passed to the configured error_handler and the returned map is merged with the pre-handler path via Map.put_new(handled, :path, path). Because put_new defers to the handler only when the handler itself set :path, a sanitizing handler that returns a fresh map or deletes :path has that decision reverted. The re-injected path comes from build_error_path/5, which falls back to raw internal Ash attribute and argument names when no field_names mapping is configured. A validation failure on a non-exposed or nested field therefore returns internal names in the GraphQL error path, defeating the application's redaction.
This issue affects ash_graphql: from 1.9.0 before 1.11.0.
In AshGraphql.Errors, each error is passed to the configured error_handler and the returned map is merged with the pre-handler path via Map.put_new(handled, :path, path). Because put_new defers to the handler only when the handler itself set :path, a sanitizing handler that returns a fresh map or deletes :path has that decision reverted. The re-injected path comes from build_error_path/5, which falls back to raw internal Ash attribute and argument names when no field_names mapping is configured. A validation failure on a non-exposed or nested field therefore returns internal names in the GraphQL error path, defeating the application's redaction.
This issue affects ash_graphql: from 1.9.0 before 1.11.0.
References
- https://github.com URL
- https://github.com/ash-project/ash_graphql/security/advisories/GHSA-ppr2-g9h8-w7... vendor-advisory related
- https://cna.erlef.org/cves/CVE-2026-78693.html related
- https://osv.dev/vulnerability/EEF-CVE-2026-78693 related
- https://github.com/ash-project/ash_graphql/commit/78e90d369f09f44c534816de541e60... patch
- https://hex.pm/packages/ash_graphql Product
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/78xxx/CVE-2026-78693... Vendor Advisory
- https://github.com/ash-project/ash_graphql Product
- https://nvd.nist.gov/vuln/detail/CVE-2026-78693 Vendor Advisory
- https://repo.hex.pm URL
Severity
7.8
High
Exploitation
EPSS <1%
Type
CWE-209Generation of Error Message Containing Sensitive Information
Timeline
Published30 Aug 2026
Updated2 Sep 2026
First seen30 Aug 2026
Sources
CVE-2026-78693 · NVD
CVE-2026-78693 · MITRE
EEF-CVE-2026-78693 · OSV
GHSA-ppr2-g9h8-w7qp · GHSA
CVE-2026-78693 · OSV
Monitor software like this
Free during beta