CVE-2026-81633 ash-project CVE debrief

Who should care

Users of ash_graphql library versions from 0.27.0 before 1.11.0, developers of applications using affected ash_graphql versions, and security teams monitoring for potential information exposure via stack traces should be aware of this vulnerability. They should verify and apply vendor remediation, implement compensating controls to monitor and restrict relay node queries, conduct inventory checks for affected ash_graphql versions, and enhance logging and exception tracking for relay node errors. Security teams should prioritize defensive reviews due to potential information exposure via stack traces for unauthenticated clients.

Technical summary

The ash_graphql library has an Improper Input Validation vulnerability allowing unauthenticated clients to crash relay nodes with an unhandled KeyError, potentially exposing stack traces. The issue arises from AshGraphql.Graphql.Resolver.resolve_node/2 decoding client-supplied global IDs without validating the type segment. This causes Map.fetch!/2 to raise on a missing key, aborting the resolver before error handling. The fix uses Map.fetch/2 and returns an 'Invalid node id' error for unknown types. Affected versions are from 0.27.0 before 1.11.0. Users should verify and apply vendor remediation, implement compensating controls, and conduct inventory checks for affected versions.

Defensive priority

Medium-priority defensive review recommended due to potential information exposure via stack traces for unauthenticated clients.

Recommended defensive actions

• Verify and apply vendor remediation for ash_graphql versions from 0.27.0 before 1.11.0
• Implement compensating controls to monitor and restrict relay node queries
• Conduct inventory checks for affected ash_graphql versions
• Enhance logging and exception tracking for relay node errors
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

Evidence is limited; primary official records indicate an Improper Input Validation vulnerability in ash_graphql allowing unauthenticated clients to crash relay nodes with an unhandled KeyError, potentially exposing stack traces. Defensive verification tasks are recommended.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.