CVE-2026-82367 ash-project CVE debrief

Who should care

Users of ash_graphql library, especially those handling sensitive data, should review vendor documentation and apply patches to prevent exposure of data elements to wrong sessions. They should also conduct inventory checks for affected systems and implement compensating controls for sensitive data exposure.

Technical summary

The ash_graphql library has a vulnerability where subscription records can be delivered to the wrong subscriber's topic due to improper handling of batch-resolved data. AshGraphql.Subscription.Batcher.do_send/5 reads the resolved batch from the process dictionary via Process.get(:batch_resolved) and then unconditionally deletes it. That is sound only inside a task the library owns. On the :backpressure_sync and :noproc fallbacks do_send/5 runs inline in the publishing caller's process, so if a resolver inside an outer do_send/5 triggers another synchronous Ash notification, the inner call finds the outer run's value still under :batch_resolved, adopts it as its own result, and publishes it to the inner topic, a different subscription document with a different actor and tenant. It then deletes the key, so the outer run publishes nothing. The key is not namespaced by run, so records cannot be told apart. The fix saves, clears, and restores :batch_resolved around each run.

Defensive priority

Review and apply vendor patches for ash_graphql to prevent exposure of data elements to wrong sessions.

Recommended defensive actions

• Review vendor documentation and apply patches for ash_graphql
• Conduct inventory checks for affected systems
• Implement compensating controls for sensitive data exposure
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

Evidence is limited; verify affected scope and vendor remediation. Inventory checks and compensating controls may be necessary. The CVE record was published on 2026-08-30T19:17:29.877Z and has not been modified since then. Users should review vendor documentation for ash_graphql and apply patches to prevent exposure of data elements to wrong sessions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.