CVE-2026-78693 - Incomplete redaction re-attaches the original error path in AshGraphql, leaking internal field names
Brief
CVE ID : CVE-2026-78693
Published : Aug. 30, 2026, 6:28 p. m.
- 47 minutes ago
Description : Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_graphql allows a remote client to read internal field names that an application configured its error_handler to redact.
In AshGraphql. Errors, each error is passed to the configured error_handler and the returned map is merged with the pre-handler path via Map. put_new(handled, :path, path). Because put_new defers to the handler only when the handler itself set :path, a sanitizing handler that returns a fresh map or deletes :path has that decision reverted.
The re-injected path comes from build_error_path/5, which falls back to raw internal Ash attribute and argument names when no field_names mapping is configured.