CVE-2026-82759 team-alembic CVE debrief

Who should care

Defenders who use AshAuthentication and have configured the audit log add-on's :hash privacy mode should assess their exposure and prioritize verifying and upgrading to a fixed version.

Why it matters

The vulnerability in AshAuthentication allows readers of the audit store to recover client IP addresses that were meant to be pseudonymised, which can have significant operational impacts on defenders who use the affected versions.

• Readers of the audit store can recover client IP addresses that were meant to be pseudonymised
• The vulnerability allows for the enumeration of IP addresses once the hash leaks
• Defenders should verify and upgrade to a fixed version to prevent exposure

Technical summary

The vulnerability is caused by the use of a predictable salt in the :hash privacy mode of the audit log add-on, which allows readers of the audit store to recover client IP addresses. The salt is read from the :audit_log_ip_salt or :secret application config keys, and falls back to a constant default value if neither is set. This issue affects ash_authentication versions from 4.12.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14. The use of a predictable salt makes the hash table precomputable, allowing for the enumeration of IP addresses once the hash leaks.

Defensive priority

Defenders should prioritize verifying and upgrading to a fixed version of AshAuthentication, specifically version 4.15.0 or later, or 5.0.0-rc.14 or later, and review their audit log configurations.

Recommended defensive actions

• Verify and upgrade to a fixed version of AshAuthentication
• Review audit log configurations
• Configure a secure salt value
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability is caused by the use of a predictable salt in the :hash privacy mode of the audit log add-on, which allows readers of the audit store to recover client IP addresses. The salt is read from the :audit_log_ip_salt or :secret application config keys, and falls back to a constant default value if neither is set.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.