Answer in brief
CVE-2026-78693 records a Medium severity (CVSS 6.9) vulnerability in Incomplete redaction re-attaches the original error path in AshGraphql, leaking internal field names. The current sources do not mark it as known exploited. The current feed maps ash-project/ash_graphql (generic), ash-project/ash_graphql (generic), ash-project/ash-project/ash_graphql (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 6.9. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps ash-project/ash_graphql (generic), ash-project/ash_graphql (generic), ash-project/ash-project/ash_graphql (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| ash-project/ash_graphqlgeneric | >=6d2d8d995906d68cc245d209a9b3f9853405eb61 <78e90d369f09f44c534816de541e60841066a467 | 78e90d369f09f44c534816de541e60841066a467 |
| ash-project/ash_graphqlgeneric | >=1.9.0 <1.11.0 | 1.11.0 |
| ash-project/ash-project/ash_graphqlgeneric | >=6d2d8d995906d68cc245d209a9b3f9853405eb61 <78e90d369f09f44c534816de541e60841066a467 | 78e90d369f09f44c534816de541e60841066a467 |
Published upstream
Aug 30, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 1, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 30, 2026
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_graphql allows a remote client to read internal field names that an application configured its error_handler to redact. In AshGraphql.Errors, each error is passed to the configured error_handler and the returned map is merged with the pre-handler path via Map.put_new(handled, :path, path). Because put_new defers to the handler only when the handler itself set :path, a sanitizing handler that returns a fresh map or deletes :path has that decision reverted. The re-injected path comes from build_error_path/5, which falls back to raw internal Ash attribute and argument names when no field_names mapping is configured. A validation failure on a non-exposed or nested field therefore returns internal names in the GraphQL error path, defeating the application's redaction. This issue affects ash_graphql: from 1.9.0 before 1.11.0.
Quoted source text, attributed separately from HOL analysis.