Search
Find merged stories by title or summary.
cve-2026-78693
Incomplete redaction re-attaches the original error path in AshGraphql, leaking internal field names
CVE-2026-78693 - Incomplete redaction re-attaches the original error path in AshGraphql, leaking internal field names
CVE ID : CVE-2026-78693 Published : Aug. 30, 2026, 6:28 p. m. • 47 minutes ago Description : Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_graphql allows a remote client to read internal field names that an application configured its error_handler to redact. In AshGraphql. Errors, each error is passed to the configured error_handler and the returned map is merged with the pre-handler path via Map. put_new(handled, :path, path). Because put_new defers to the handler only when the handler itself set :path, a sanitizing handler that returns a fresh map or deletes :path has that decision reverted. The re-injected path comes from build_error_path/5, which falls back to raw internal Ash attribute and argument names when no field_names mapping is configured.
You've reached the end of current stories for this search.