Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2026-81633: Ash GraphQL crashes on unknown node type
CVE-2026-81633 · published 4 days ago
Summary
The Ash GraphQL service can be forced to stop working when a user sends a specially crafted request that includes an unknown type identifier. This causes the system to throw an unhandled error and may reveal internal details. Updating to the latest version of the Ash GraphQL library resolves the issue.
What to do
- Update ash_graphql to version 1.11.0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | ash-project | ash_graphql |
< 1.11.0 < c8863ed8e5c21f1bfb6125f1d24e78443dfc6351 |
| Hex | – | ash_graphql |
>= 0.27.0, < 1.11.0 Fix: upgrade to 1.11.0
|
Original advisory text
Unhandled KeyError in AshGraphql relay node resolution crashes queries via an unknown type segment
Improper Input Validation vulnerability in ash-project ash_graphql allows an unauthenticated client to crash a relay node(id: ...) query with an unhandled KeyError.
AshGraphql.Graphql.Resolver.resolve_node/2 decodes the client-supplied global ID with decode_relay_id/1, which only base64-decodes the string and splits it on : without validating the type segment. The decoded type is passed straight to Map.fetch!(type_to_domain_and_resource_map, type). Because fetch! raises on a missing key, a relay ID whose type segment is a valid atom that is not a relay-exposed type aborts the resolver before its resolve/2 clauses and their rescue handlers run, so the error never becomes a GraphQL error and may expose a stacktrace. Common resource names are easy to guess. The fix uses Map.fetch/2 and returns an Invalid node id error for unknown types.
This issue affects ash_graphql: from 0.27.0 before 1.11.0.
AshGraphql.Graphql.Resolver.resolve_node/2 decodes the client-supplied global ID with decode_relay_id/1, which only base64-decodes the string and splits it on : without validating the type segment. The decoded type is passed straight to Map.fetch!(type_to_domain_and_resource_map, type). Because fetch! raises on a missing key, a relay ID whose type segment is a valid atom that is not a relay-exposed type aborts the resolver before its resolve/2 clauses and their rescue handlers run, so the error never becomes a GraphQL error and may expose a stacktrace. Common resource names are easy to guess. The fix uses Map.fetch/2 and returns an Invalid node id error for unknown types.
This issue affects ash_graphql: from 0.27.0 before 1.11.0.
References
- https://github.com/ash-project/ash_graphql/security/advisories/GHSA-mrgv-g7gf-r9... vendor-advisory related
- https://cna.erlef.org/cves/CVE-2026-81633.html related
- https://osv.dev/vulnerability/EEF-CVE-2026-81633 related
- https://github.com/ash-project/ash_graphql/commit/c8863ed8e5c21f1bfb6125f1d24e78... patch
- https://hex.pm/packages/ash_graphql Product
- https://github.com URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81633... Vendor Advisory
- https://github.com/ash-project/ash_graphql Product
- https://nvd.nist.gov/vuln/detail/CVE-2026-81633 Vendor Advisory
- https://repo.hex.pm URL
Severity
7.8
High
Exploitation
EPSS <1%
Type
CWE-20Improper Input Validation
Timeline
Published30 Aug 2026
Updated2 Sep 2026
First seen30 Aug 2026
Sources
CVE-2026-81633 · NVD
CVE-2026-81633 · MITRE
EEF-CVE-2026-81633 · OSV
GHSA-mrgv-g7gf-r96h · GHSA
CVE-2026-81633 · OSV
Monitor software like this
Free during beta