CVE-2026-78693

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-78693
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-78693.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-78693
Aliases
Published
2026-08-30T18:28:35.282Z
Modified
2026-09-03T03:30:55.936197712Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Incomplete redaction re-attaches the original error path in AshGraphql, leaking internal field names
Details

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashgraphql allows a remote client to read internal field names that an application configured its errorhandler to redact.

In AshGraphql.Errors, each error is passed to the configured errorhandler and the returned map is merged with the pre-handler path via Map.putnew(handled, :path, path). Because putnew defers to the handler only when the handler itself set :path, a sanitizing handler that returns a fresh map or deletes :path has that decision reverted. The re-injected path comes from builderrorpath/5, which falls back to raw internal Ash attribute and argument names when no fieldnames mapping is configured. A validation failure on a non-exposed or nested field therefore returns internal names in the GraphQL error path, defeating the application's redaction.

This issue affects ash_graphql: from 1.9.0 before 1.11.0.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/78xxx/CVE-2026-78693.json",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "6d2d8d995906d68cc245d209a9b3f9853405eb61"
                },
                {
                    "fixed": "78e90d369f09f44c534816de541e60841066a467"
                }
            ]
        }
    ],
    "cna_assigner": "EEF",
    "cwe_ids": [
        "CWE-209"
    ]
}
References

Affected packages

Git / github.com/ash-project/ash_graphql

Affected ranges

Type
GIT
Repo
https://github.com/ash-project/ash_graphql
Events
Introduced
374261a4f243d67213f7527c93dde688dcb6ecf2
Fixed
4e2c5476ecfd2c701488627ee46e6eefc58c982e
Fixed
78e90d369f09f44c534816de541e60841066a467
Database specific
Show details 
{
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "1.9.0"
        },
        {
            "fixed": "1.11.0"
        }
    ]
}

Affected versions

v1.*
v1.10.0
v1.10.1
v1.9.0
v1.9.1
v1.9.2
v1.9.3
v1.9.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-78693.json"