Vulnerability-Lookup

FKIE_CVE-2026-81322

Vulnerability from fkie_nvd - Published: 2026-08-30 18:17 - Updated: 2026-08-30 18:17

Severity

2.1 (Low) - CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Summary

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ash-project ash_cloak allows anyone with access to logs, error trackers, or crash reports, or anyone who can trigger a validation error, to recover the plaintext of a field the library encrypts. AshCloak.Transformers.SetUpEncryption removes each cloaked attribute from the action's accept list and adds an action argument that carries the plaintext into the encryption change. That argument is built with sensitive?: attr.sensitive?, inheriting the flag from the source attribute, so a cloaked attribute declared without sensitive? true produces a non-sensitive argument. It is the only place the cleartext value lives, and the one place Ash will not redact: it appears verbatim in inspect(changeset), Ash.Error.Invalid and validation error messages, telemetry, :sys dumps, and error-tracker payloads. The generated encrypted attribute and decrypt calculation are already hardcoded sensitive. This issue affects ash_cloak: from 0.1.0 before 0.4.0.

References

	URL	Tags
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://cna.erlef.org/cves/CVE-2026-81322.html
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://github.com/ash-project/ash_cloak/commit/ef49cfc832329fc8bc70ec6542a4dfff5dafd076
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://github.com/ash-project/ash_cloak/security/advisories/GHSA-qp4v-vvrg-8ggx
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://osv.dev/vulnerability/EEF-CVE-2026-81322

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:ash-project:ash_cloak:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.AshCloak.Transformers.SetUpEncryption\u0027"
          ],
          "packageName": "ash_cloak",
          "packageURL": "pkg:hex/ash_cloak",
          "product": "ash_cloak",
          "programFiles": [
            "lib/ash_cloak/transformers/set_up_encryption.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.AshCloak.Transformers.SetUpEncryption\u0027:rewrite_actions/2"
            }
          ],
          "repo": "https://github.com/ash-project/ash_cloak",
          "vendor": "ash-project",
          "versions": [
            {
              "lessThan": "0.4.0",
              "status": "affected",
              "version": "0.1.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:ash-project:ash_cloak:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.AshCloak.Transformers.SetUpEncryption\u0027"
          ],
          "packageName": "ash-project/ash_cloak",
          "packageURL": "pkg:github/ash-project/ash_cloak",
          "product": "ash_cloak",
          "programFiles": [
            "lib/ash_cloak/transformers/set_up_encryption.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.AshCloak.Transformers.SetUpEncryption\u0027:rewrite_actions/2"
            }
          ],
          "repo": "https://github.com/ash-project/ash_cloak",
          "vendor": "ash-project",
          "versions": [
            {
              "lessThan": "ef49cfc832329fc8bc70ec6542a4dfff5dafd076",
              "status": "affected",
              "version": "f1595a77fdfa9bfc672f84c2f77feb9e7bf895fc",
              "versionType": "git"
            }
          ]
        }
      ],
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ash-project ash_cloak allows anyone with access to logs, error trackers, or crash reports, or anyone who can trigger a validation error, to recover the plaintext of a field the library encrypts.\n\nAshCloak.Transformers.SetUpEncryption removes each cloaked attribute from the action\u0027s accept list and adds an action argument that carries the plaintext into the encryption change. That argument is built with sensitive?: attr.sensitive?, inheriting the flag from the source attribute, so a cloaked attribute declared without sensitive? true produces a non-sensitive argument. It is the only place the cleartext value lives, and the one place Ash will not redact: it appears verbatim in inspect(changeset), Ash.Error.Invalid and validation error messages, telemetry, :sys dumps, and error-tracker payloads. The generated encrypted attribute and decrypt calculation are already hardcoded sensitive.\n\nThis issue affects ash_cloak: from 0.1.0 before 0.4.0."
    }
  ],
  "id": "CVE-2026-81322",
  "lastModified": "2026-08-30T18:17:00.010",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "attackVector": "LOCAL",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 2.1,
          "baseSeverity": "LOW",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "LOW",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-08-30T18:17:00.010",
  "references": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://cna.erlef.org/cves/CVE-2026-81322.html"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://github.com/ash-project/ash_cloak/commit/ef49cfc832329fc8bc70ec6542a4dfff5dafd076"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://github.com/ash-project/ash_cloak/security/advisories/GHSA-qp4v-vvrg-8ggx"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-81322"
    }
  ],
  "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ],
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "type": "Secondary"
    }
  ]
}

CVE-2026-81322 (GCVE-0-2026-81322)

Vulnerability from cvelistv5 – Published: 2026-08-30 18:06 – Updated: 2026-08-30 18:06

Title

Cloaked plaintext leaks through a non-sensitive action argument in AshCloak

Summary

Severity

2.1 (Low)


                        
                          CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

EEF mitre root

References

4 references

URL	Tags
https://github.com/ash-project/ash_cloak/security…	vendor-advisoryrelated
https://cna.erlef.org/cves/CVE-2026-81322.html	related
https://osv.dev/vulnerability/EEF-CVE-2026-81322	related
https://github.com/ash-project/ash_cloak/commit/e…	patch

Impacted products

2 products

Vendor	Product	Version
ash-project	ash_cloak	Affected: 0.1.0 , < 0.4.0 (semver) cpe:2.3:a:ash-project:ash_cloak::::::::
ash-project	ash_cloak	Affected: f1595a77fdfa9bfc672f84c2f77feb9e7bf895fc , < ef49cfc832329fc8bc70ec6542a4dfff5dafd076 (git) cpe:2.3:a:ash-project:ash_cloak::::::::

Credits

Peter Ullrich Peter Ullrich Zach Daniel / Ash Project Jonatan Männchen / EEF

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:ash-project:ash_cloak:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.AshCloak.Transformers.SetUpEncryption\u0027"
          ],
          "packageName": "ash_cloak",
          "packageURL": "pkg:hex/ash_cloak",
          "product": "ash_cloak",
          "programFiles": [
            "lib/ash_cloak/transformers/set_up_encryption.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.AshCloak.Transformers.SetUpEncryption\u0027:rewrite_actions/2"
            }
          ],
          "repo": "https://github.com/ash-project/ash_cloak",
          "vendor": "ash-project",
          "versions": [
            {
              "lessThan": "0.4.0",
              "status": "affected",
              "version": "0.1.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:ash-project:ash_cloak:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.AshCloak.Transformers.SetUpEncryption\u0027"
          ],
          "packageName": "ash-project/ash_cloak",
          "packageURL": "pkg:github/ash-project/ash_cloak",
          "product": "ash_cloak",
          "programFiles": [
            "lib/ash_cloak/transformers/set_up_encryption.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.AshCloak.Transformers.SetUpEncryption\u0027:rewrite_actions/2"
            }
          ],
          "repo": "https://github.com/ash-project/ash_cloak",
          "vendor": "ash-project",
          "versions": [
            {
              "lessThan": "ef49cfc832329fc8bc70ec6542a4dfff5dafd076",
              "status": "affected",
              "version": "f1595a77fdfa9bfc672f84c2f77feb9e7bf895fc",
              "versionType": "git"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eA resource must cloak an attribute that is not itself declared \u003ccode\u003esensitive? true\u003c/code\u003e, and the plaintext must reach an output that renders it (a create/update validation error returned to the client, or logs, telemetry, or crash reports that capture the changeset or error).\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "A resource must cloak an attribute that is not itself declared `sensitive? true`, and the plaintext must reach an output that renders it (a create/update validation error returned to the client, or logs, telemetry, or crash reports that capture the changeset or error)."
            }
          ],
          "value": "A resource must cloak an attribute that is not itself declared sensitive? true, and the plaintext must reach an output that renders it (a create/update validation error returned to the client, or logs, telemetry, or crash reports that capture the changeset or error)."
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:ash-project:ash_cloak:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.4.0",
                  "versionStartIncluding": "0.1.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Peter Ullrich"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Peter Ullrich"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Zach Daniel / Ash Project"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jonatan M\u00e4nnchen / EEF"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eExposure of Sensitive Information to an Unauthorized Actor vulnerability in ash-project ash_cloak allows anyone with access to logs, error trackers, or crash reports, or anyone who can trigger a validation error, to recover the plaintext of a field the library encrypts.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eAshCloak.Transformers.SetUpEncryption\u003c/code\u003e removes each cloaked attribute from the action\u0027s \u003ccode\u003eaccept\u003c/code\u003e list and adds an action argument that carries the plaintext into the encryption change. That argument is built with \u003ccode\u003esensitive?: attr.sensitive?\u003c/code\u003e, inheriting the flag from the source attribute, so a cloaked attribute declared without \u003ccode\u003esensitive? true\u003c/code\u003e produces a non-sensitive argument. It is the only place the cleartext value lives, and the one place Ash will not redact: it appears verbatim in \u003ccode\u003einspect(changeset)\u003c/code\u003e, \u003ccode\u003eAsh.Error.Invalid\u003c/code\u003e and validation error messages, telemetry, \u003ccode\u003e:sys\u003c/code\u003e dumps, and error-tracker payloads. The generated encrypted attribute and decrypt calculation are already hardcoded sensitive.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_cloak: from 0.1.0 before 0.4.0.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ash-project ash_cloak allows anyone with access to logs, error trackers, or crash reports, or anyone who can trigger a validation error, to recover the plaintext of a field the library encrypts.\n\n`AshCloak.Transformers.SetUpEncryption` removes each cloaked attribute from the action\u0027s `accept` list and adds an action argument that carries the plaintext into the encryption change. That argument is built with `sensitive?: attr.sensitive?`, inheriting the flag from the source attribute, so a cloaked attribute declared without `sensitive? true` produces a non-sensitive argument. It is the only place the cleartext value lives, and the one place Ash will not redact: it appears verbatim in `inspect(changeset)`, `Ash.Error.Invalid` and validation error messages, telemetry, `:sys` dumps, and error-tracker payloads. The generated encrypted attribute and decrypt calculation are already hardcoded sensitive.\n\nThis issue affects ash_cloak: from 0.1.0 before 0.4.0."
            }
          ],
          "value": "Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ash-project ash_cloak allows anyone with access to logs, error trackers, or crash reports, or anyone who can trigger a validation error, to recover the plaintext of a field the library encrypts.\n\nAshCloak.Transformers.SetUpEncryption removes each cloaked attribute from the action\u0027s accept list and adds an action argument that carries the plaintext into the encryption change. That argument is built with sensitive?: attr.sensitive?, inheriting the flag from the source attribute, so a cloaked attribute declared without sensitive? true produces a non-sensitive argument. It is the only place the cleartext value lives, and the one place Ash will not redact: it appears verbatim in inspect(changeset), Ash.Error.Invalid and validation error messages, telemetry, :sys dumps, and error-tracker payloads. The generated encrypted attribute and decrypt calculation are already hardcoded sensitive.\n\nThis issue affects ash_cloak: from 0.1.0 before 0.4.0."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-37",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-37 Retrieve Embedded Sensitive Data"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 2.1,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-30T18:06:33.478Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/ash-project/ash_cloak/security/advisories/GHSA-qp4v-vvrg-8ggx"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-81322.html"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-81322"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/ash-project/ash_cloak/commit/ef49cfc832329fc8bc70ec6542a4dfff5dafd076"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Cloaked plaintext leaks through a non-sensitive action argument in AshCloak"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-81322",
    "datePublished": "2026-08-30T18:06:33.478Z",
    "dateReserved": "2026-08-30T06:00:01.266Z",
    "dateUpdated": "2026-08-30T18:06:33.478Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

FKIE_CVE-2026-81322

CVE-2026-81322 (GCVE-0-2026-81322)

Tags

Sightings

Nomenclature