Answer in brief
CVE-2026-94206 records a Medium severity (CVSS 6.3) vulnerability in Cloak PBKDF2 field ignores the configured iteration count and runs only :size rounds. The current sources do not mark it as known exploited. The current feed maps danielberkompas/cloak (generic), danielberkompas/cloak_ecto (generic), danielberkompas/danielberkompas/cloak (generic), danielberkompas/danielberkompas/cloak_ecto (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 6.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps danielberkompas/cloak (generic), danielberkompas/cloak_ecto (generic), danielberkompas/danielberkompas/cloak (generic), danielberkompas/danielberkompas/cloak_ecto (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| danielberkompas/cloakgeneric | >=0.7.0 <1.0.0-alpha.0 | 1.0.0-alpha.0 |
| danielberkompas/cloak_ectogeneric | >=1.0.0-alpha.0 <* | * |
| danielberkompas/danielberkompas/cloakgeneric | >=8699e6417a162c39d9f0ef63511bd23d3f38d1d2 <681c9702b7cd9afe0e5a840751ab009f550c69a9 | 681c9702b7cd9afe0e5a840751ab009f550c69a9 |
| danielberkompas/danielberkompas/cloak_ectogeneric | >=a8fa1642b02f1c445a1ee8794c9095eb0921f8f3 <* | * |
Published upstream
Oct 6, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 6, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 6, 2026
Use of Password Hash With Insufficient Computational Effort vulnerability in danielberkompas cloak_ecto and danielberkompas cloak allows an attacker who holds the hashed values and the configured secret to brute-force low-entropy plaintexts much faster than configured. The dump/1 callback that Cloak.Ecto.PBKDF2 (Cloak.Fields.PBKDF2 in cloak before the Ecto code moved to cloak_ecto) injects into a field module calls :pbkdf2.pbkdf2/4 with config[:size] in the iteration-count position. The :iterations setting is validated but never used. With the cloak_ecto defaults (iterations: 600_000, size: 32) each hash runs 32 PBKDF2 rounds instead of 600,000, so offline guessing of values such as email addresses costs about 18,750 times less than configured. This issue affects cloak_ecto: from 1.0.0-alpha.0 onward; cloak: from 0.7.0 before 1.0.0-alpha.0.
Quoted source text, attributed separately from HOL analysis.