CVE-2026-81322 (GCVE-0-2026-81322)
Vulnerability from cvelistv5
Published
2026-08-30 18:06
Modified
2026-08-30 18:06
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Summary
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ash-project ash_cloak allows anyone with access to logs, error trackers, or crash reports, or anyone who can trigger a validation error, to recover the plaintext of a field the library encrypts.
AshCloak.Transformers.SetUpEncryption removes each cloaked attribute from the action's accept list and adds an action argument that carries the plaintext into the encryption change. That argument is built with sensitive?: attr.sensitive?, inheriting the flag from the source attribute, so a cloaked attribute declared without sensitive? true produces a non-sensitive argument. It is the only place the cleartext value lives, and the one place Ash will not redact: it appears verbatim in inspect(changeset), Ash.Error.Invalid and validation error messages, telemetry, :sys dumps, and error-tracker payloads. The generated encrypted attribute and decrypt calculation are already hardcoded sensitive.
This issue affects ash_cloak: from 0.1.0 before 0.4.0.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| ash-project | ash_cloak |
Version: 0.1.0 ≤ cpe:2.3:a:ash-project:ash_cloak:*:*:*:*:*:*:*:* |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_cloak:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshCloak.Transformers.SetUpEncryption\u0027"
],
"packageName": "ash_cloak",
"packageURL": "pkg:hex/ash_cloak",
"product": "ash_cloak",
"programFiles": [
"lib/ash_cloak/transformers/set_up_encryption.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshCloak.Transformers.SetUpEncryption\u0027:rewrite_actions/2"
}
],
"repo": "https://github.com/ash-project/ash_cloak",
"vendor": "ash-project",
"versions": [
{
"lessThan": "0.4.0",
"status": "affected",
"version": "0.1.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_cloak:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshCloak.Transformers.SetUpEncryption\u0027"
],
"packageName": "ash-project/ash_cloak",
"packageURL": "pkg:github/ash-project/ash_cloak",
"product": "ash_cloak",
"programFiles": [
"lib/ash_cloak/transformers/set_up_encryption.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshCloak.Transformers.SetUpEncryption\u0027:rewrite_actions/2"
}
],
"repo": "https://github.com/ash-project/ash_cloak",
"vendor": "ash-project",
"versions": [
{
"lessThan": "ef49cfc832329fc8bc70ec6542a4dfff5dafd076",
"status": "affected",
"version": "f1595a77fdfa9bfc672f84c2f77feb9e7bf895fc",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA resource must cloak an attribute that is not itself declared \u003ccode\u003esensitive? true\u003c/code\u003e, and the plaintext must reach an output that renders it (a create/update validation error returned to the client, or logs, telemetry, or crash reports that capture the changeset or error).\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "A resource must cloak an attribute that is not itself declared `sensitive? true`, and the plaintext must reach an output that renders it (a create/update validation error returned to the client, or logs, telemetry, or crash reports that capture the changeset or error)."
}
],
"value": "A resource must cloak an attribute that is not itself declared sensitive? true, and the plaintext must reach an output that renders it (a create/update validation error returned to the client, or logs, telemetry, or crash reports that capture the changeset or error)."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_cloak:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.4.0",
"versionStartIncluding": "0.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eExposure of Sensitive Information to an Unauthorized Actor vulnerability in ash-project ash_cloak allows anyone with access to logs, error trackers, or crash reports, or anyone who can trigger a validation error, to recover the plaintext of a field the library encrypts.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eAshCloak.Transformers.SetUpEncryption\u003c/code\u003e removes each cloaked attribute from the action\u0027s \u003ccode\u003eaccept\u003c/code\u003e list and adds an action argument that carries the plaintext into the encryption change. That argument is built with \u003ccode\u003esensitive?: attr.sensitive?\u003c/code\u003e, inheriting the flag from the source attribute, so a cloaked attribute declared without \u003ccode\u003esensitive? true\u003c/code\u003e produces a non-sensitive argument. It is the only place the cleartext value lives, and the one place Ash will not redact: it appears verbatim in \u003ccode\u003einspect(changeset)\u003c/code\u003e, \u003ccode\u003eAsh.Error.Invalid\u003c/code\u003e and validation error messages, telemetry, \u003ccode\u003e:sys\u003c/code\u003e dumps, and error-tracker payloads. The generated encrypted attribute and decrypt calculation are already hardcoded sensitive.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_cloak: from 0.1.0 before 0.4.0.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ash-project ash_cloak allows anyone with access to logs, error trackers, or crash reports, or anyone who can trigger a validation error, to recover the plaintext of a field the library encrypts.\n\n`AshCloak.Transformers.SetUpEncryption` removes each cloaked attribute from the action\u0027s `accept` list and adds an action argument that carries the plaintext into the encryption change. That argument is built with `sensitive?: attr.sensitive?`, inheriting the flag from the source attribute, so a cloaked attribute declared without `sensitive? true` produces a non-sensitive argument. It is the only place the cleartext value lives, and the one place Ash will not redact: it appears verbatim in `inspect(changeset)`, `Ash.Error.Invalid` and validation error messages, telemetry, `:sys` dumps, and error-tracker payloads. The generated encrypted attribute and decrypt calculation are already hardcoded sensitive.\n\nThis issue affects ash_cloak: from 0.1.0 before 0.4.0."
}
],
"value": "Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ash-project ash_cloak allows anyone with access to logs, error trackers, or crash reports, or anyone who can trigger a validation error, to recover the plaintext of a field the library encrypts.\n\nAshCloak.Transformers.SetUpEncryption removes each cloaked attribute from the action\u0027s accept list and adds an action argument that carries the plaintext into the encryption change. That argument is built with sensitive?: attr.sensitive?, inheriting the flag from the source attribute, so a cloaked attribute declared without sensitive? true produces a non-sensitive argument. It is the only place the cleartext value lives, and the one place Ash will not redact: it appears verbatim in inspect(changeset), Ash.Error.Invalid and validation error messages, telemetry, :sys dumps, and error-tracker payloads. The generated encrypted attribute and decrypt calculation are already hardcoded sensitive.\n\nThis issue affects ash_cloak: from 0.1.0 before 0.4.0."
}
],
"impacts": [
{
"capecId": "CAPEC-37",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-37 Retrieve Embedded Sensitive Data"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 2.1,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-30T18:06:33.478Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash_cloak/security/advisories/GHSA-qp4v-vvrg-8ggx"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-81322.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-81322"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_cloak/commit/ef49cfc832329fc8bc70ec6542a4dfff5dafd076"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Cloaked plaintext leaks through a non-sensitive action argument in AshCloak"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-81322",
"datePublished": "2026-08-30T18:06:33.478Z",
"dateReserved": "2026-08-30T06:00:01.266Z",
"dateUpdated": "2026-08-30T18:06:33.478Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…