CVE-2026-81316 ash-project CVE debrief

Who should care

Users of ash-project ash_sql, especially those with sensitive aggregate data, should review and apply patches to prevent unauthorized disclosure of aggregate values. This includes operators managing ash_sql deployments, platform administrators, vulnerability management teams, and security teams responsible for monitoring and protecting sensitive data. Reviewing compensating controls and conducting inventory checks to identify and update vulnerable ash_sql instances are also recommended.

Technical summary

The ash-project ash_sql library incorrectly handles aggregate queries with different filters, allowing a caller to receive aggregate values computed over rows that should have been excluded by a more restrictive filter. This issue affects ash_sql versions from 0.1.0 before 0.7.1. The vulnerability arises from AshSql.Aggregate.different_queries?/2 reporting two aggregate queries as different only when their filter and their sort both differ. As aggregate queries rarely carry a sort, two aggregates that share a name but carry entirely different filters compare as identical.

Defensive priority

Review and apply vendor patches for ash_sql to prevent unauthorized disclosure of aggregate values.

Recommended defensive actions

• Review and apply vendor patches for ash_sql to prevent unauthorized disclosure of aggregate values.
• Implement compensating controls to monitor and restrict access to sensitive aggregate data.
• Conduct inventory checks to identify and update vulnerable ash_sql instances.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE-2026-81316 record indicates an Incorrect Authorization vulnerability in ash-project ash_sql, allowing disclosure of aggregate values across authorization or tenancy boundaries due to inadequate filter checks in aggregate queries. Evidence is based on official CVE and NVD records, as well as references from Erlef, GitHub, and OSV. To verify, defenders should review the official advisory, assess affected deployments, and monitor for suspicious aggregate query activity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.