CVE-2026-78693: ash_graphql Information Disclosure Vulnerability

CVE-2026-78693 Overview

CVE-2026-78693 is an information disclosure vulnerability in the ash_graphql library maintained by the ash-project. The flaw resides in AshGraphql.Errors, where the error path is re-attached after a user-supplied error_handler runs. Applications that configured their handler to redact or drop the :path key have that decision reverted by a Map.put_new(handled, :path, path) call. As a result, GraphQL error responses can leak raw internal Ash attribute and argument names for non-exposed or nested fields. The issue is classified under [CWE-209] (Generation of Error Message Containing Sensitive Information) and affects ash_graphql from 1.9.0 before 1.11.0.

Critical Impact
Remote unauthenticated clients can read internal field names that the application explicitly configured its error handler to redact, defeating information-hiding controls on non-exposed or nested schema fields.

Affected Products

ash-project ash_graphql1.9.0
ash-project ash_graphql versions after 1.9.0 and before 1.11.0
Elixir/Erlang applications using AshGraphql with a redacting error_handler

Discovery Timeline

2026-08-30 - CVE-2026-78693 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-78693

Vulnerability Analysis

The vulnerability is a GraphQL error-path information disclosure caused by control-flow around error handler return values. In AshGraphql.Errors, each error is passed to the configured resource or domain error_handler. The library then merges the pre-handler path back into the handler's output using Map.put_new(handled, :path, path).

Map.put_new/3 only sets the key when it is absent. A sanitizing handler that returns a fresh map, or explicitly deletes :path, satisfies the "absent" condition. The library then re-injects the original path derived from build_error_path/5. That helper falls back to raw internal Ash attribute and argument names when no field_names mapping is configured. Validation failures on non-exposed or nested fields therefore surface internal names in the GraphQL response path.

Root Cause

The root cause is an incorrect assumption that a handler which omits :path intends the library to restore it. The intended semantics for a redacting handler are the opposite: omission signals redaction. Combining put_new with a raw-name fallback in build_error_path/5 reverses the application's explicit redaction decision.

Attack Vector

An unauthenticated remote client sends a GraphQL query or mutation that triggers a validation failure on a non-exposed or nested Ash attribute or argument. The server returns a standard GraphQL error, and the path array in that error contains internal Ash names instead of the redacted values the handler produced. No authentication, privileges, or user interaction are required.

text

              error_with_path

            {m, f, a} ->
-              handled = apply(m, f, [error_with_path, context | a])
-              # Ensure path is preserved after resource handler
-              Map.put_new(handled, :path, path)
+              # The path is already set on the error before the handler runs, so
+              # honor the handler's return verbatim (it may redact or drop :path).
+              apply(m, f, [error_with_path, context | a])
          end

        case AshGraphql.Domain.Info.error_handler(domain) do
          nil ->
            resource_handled_error

          {m, f, a} ->
-            handled = apply(m, f, [resource_handled_error, context | a])
-            # Ensure path is preserved after domain handler
-            Map.put_new(handled, :path, path)
+            # Honor the handler's return verbatim; do not re-attach the path it removed.
+            apply(m, f, [resource_handled_error, context | a])
        end

Source: GitHub Commit 78e90d3. The patch removes the Map.put_new re-injection and honors the handler's return value verbatim.

Detection Methods for CVE-2026-78693

Indicators of Compromise

GraphQL error responses whose path array contains internal Ash attribute or argument identifiers that do not correspond to the public schema field names.
Repeated queries or mutations from the same client that intentionally trigger validation errors on nested or non-exposed inputs.
Discrepancies between the field names appearing in errors[].path and the field names redacted or mapped by the application's error_handler.

Detection Strategies

Inspect outbound GraphQL error payloads at an application gateway or proxy and compare errors[].path entries against the published schema.
Add unit and integration tests that submit invalid input for redacted fields and assert that path matches the handler's expected redacted output.
Audit application logs for validation errors referencing internal Ash resource attributes or arguments not present in the exposed GraphQL types.

Monitoring Recommendations

Enable structured logging of GraphQL error responses, including the path field, and forward the logs to a centralized analytics platform for review.
Track error-response volume per client IP and per operation name to identify probing patterns targeting validation errors.
Monitor deployments of ash_graphql across environments and alert when a version between 1.9.0 and 1.11.0 (exclusive) is in use.

How to Mitigate CVE-2026-78693

Immediate Actions Required

Upgrade ash_graphql to version 1.11.0 or later, which removes the Map.put_new(handled, :path, path) re-injection.
Review all configured resource-level and domain-level error_handler implementations to confirm they intentionally redact or drop :path.
Configure a field_names mapping so that any path values that do surface use public names rather than internal Ash attribute or argument identifiers.

Patch Information

The fix is committed to the ash_graphql repository in commit 78e90d3 and released in version 1.11.0. Details are published in the GitHub Security Advisory GHSA-ppr2-g9h8-w7qp, the CNA advisory on cna.erlef.org, and the OSV entry EEF-CVE-2026-78693.

Workarounds

If upgrading is not immediately possible, configure a field_names mapping in AshGraphql so build_error_path/5 does not fall back to raw internal names.
Strip or rewrite the path field from GraphQL error responses at an API gateway or middleware layer before responses reach clients.
Restrict which resources and arguments are reachable through GraphQL so that validation errors cannot be triggered against non-exposed or nested fields.

bash

# Update the dependency in mix.exs and fetch the fixed release
# mix.exs
#   {:ash_graphql, "~> 1.11.0"}
mix deps.update ash_graphql
mix deps.get
mix compile