CVE-2026-78693 ash-project CVE debrief

Who should care

Organizations and developers using ash_graphql versions between 1.9.0 and before 1.11.0 should be aware of this vulnerability and take necessary actions to upgrade or mitigate the risk.

Technical summary

The CVE-2026-78693 vulnerability in ash_graphql allows a remote client to read internal field names that an application configured its error_handler to redact. This issue arises from how error handling is implemented in AshGraphql.Errors, where each error is passed to the configured error_handler and the returned map is merged with the pre-handler path. If the error_handler returns a fresh map or deletes :path, the decision is reverted, and the path comes from build_error_path/5, which falls back to raw internal Ash attribute and argument names when no field_names mapping is configured.

Defensive priority

Organizations using ash_graphql versions between 1.9.0 and before 1.11.0 should prioritize upgrading to a fixed version to prevent potential information disclosure.

Recommended defensive actions

• Upgrade ash_graphql to version 1.11.0 or later
• Review and adjust error handling configurations to prevent exposure of sensitive information
• Monitor for and address any unauthorized access attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE-2026-78693 issue arises from a vulnerability in ash_graphql, where error handling could inadvertently expose internal field names. A remote client could leverage this to read internal field names that an application configured its error_handler to redact. This occurs because the error_handler's return is merged with a pre-handler path, and if the handler returns a fresh map or deletes :path, the path from build_error_path/5 is used, which defaults to raw internal Ash attribute and argument names when no field_names mapping is configured.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.