CVE-2026-94206
- Source
- https://cve.org/CVERecord?id=CVE-2026-94206
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-94206.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-94206
- Aliases
- Published
- 2026-10-06T08:38:04Z
- Modified
- 2026-10-08T02:52:38Z
- Severity
-
- 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Cloak PBKDF2 field ignores the configured iteration count and runs only :size rounds
- Details
-
Use of Password Hash With Insufficient Computational Effort vulnerability in danielberkompas cloak_ecto and danielberkompas cloak allows an attacker who holds the hashed values and the configured secret to brute-force low-entropy plaintexts much faster than configured.
The dump/1 callback that Cloak.Ecto.PBKDF2 (Cloak.Fields.PBKDF2 in cloak before the Ecto code moved to cloak_ecto) injects into a field module calls :pbkdf2.pbkdf2/4 with config[:size] in the iteration-count position. The :iterations setting is validated but never used. With the cloak_ecto defaults (iterations: 600_000, size: 32) each hash runs 32 PBKDF2 rounds instead of 600,000, so offline guessing of values such as email addresses costs about 18,750 times less than configured.
This issue affects cloak_ecto: from 1.0.0-alpha.0 onward; cloak: from 0.7.0 before 1.0.0-alpha.0.
- Database specific
{ "cna_assigner": "EEF", "cwe_ids": [ "CWE-916" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/94xxx/CVE-2026-94206.json", "unresolved_ranges": [ { "extracted_events": [ { "introduced": "1.0.0-alpha.0" }, { "fixed": "*" }, { "introduced": "a8fa1642b02f1c445a1ee8794c9095eb0921f8f3" }, { "fixed": "*" } ], "source": "AFFECTED_FIELD" } ] }- References
-
- https://github.com
- https://osv.dev/vulnerability/EEF-CVE-2026-94206
- https://repo.hex.pm
- https://cna.erlef.org/cves/CVE-2026-94206.html
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/94xxx/CVE-2026-94206.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-94206
- https://github.com/danielberkompas/cloak/commit/681c9702b7cd9afe0e5a840751ab009f550c69a9
- https://github.com/danielberkompas/cloak/commit/8699e6417a162c39d9f0ef63511bd23d3f38d1d2
- https://github.com/danielberkompas/cloak_ecto/commit/a8fa1642b02f1c445a1ee8794c9095eb0921f8f3
- https://github.com/danielberkompas/cloak
- https://github.com/danielberkompas/cloak_ecto