{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-81322", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "state": "PUBLISHED", "assignerShortName": "EEF", "dateReserved": "2026-08-30T06:00:01.266Z", "datePublished": "2026-08-30T18:06:33.478Z", "dateUpdated": "2026-08-30T18:06:33.478Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://repo.hex.pm", "cpes": ["cpe:2.3:a:ash-project:ash_cloak:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.AshCloak.Transformers.SetUpEncryption'"], "packageName": "ash_cloak", "packageURL": "pkg:hex/ash_cloak", "product": "ash_cloak", "programFiles": ["lib/ash_cloak/transformers/set_up_encryption.ex"], "programRoutines": [{"name": "'Elixir.AshCloak.Transformers.SetUpEncryption':rewrite_actions/2"}], "repo": "https://github.com/ash-project/ash_cloak", "vendor": "ash-project", "versions": [{"lessThan": "0.4.0", "status": "affected", "version": "0.1.0", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:ash-project:ash_cloak:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.AshCloak.Transformers.SetUpEncryption'"], "packageName": "ash-project/ash_cloak", "packageURL": "pkg:github/ash-project/ash_cloak", "product": "ash_cloak", "programFiles": ["lib/ash_cloak/transformers/set_up_encryption.ex"], "programRoutines": [{"name": "'Elixir.AshCloak.Transformers.SetUpEncryption':rewrite_actions/2"}], "repo": "https://github.com/ash-project/ash_cloak", "vendor": "ash-project", "versions": [{"lessThan": "ef49cfc832329fc8bc70ec6542a4dfff5dafd076", "status": "affected", "version": "f1595a77fdfa9bfc672f84c2f77feb9e7bf895fc", "versionType": "git"}]}], "configurations": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>A resource must cloak an attribute that is not itself declared <code>sensitive? true</code>, and the plaintext must reach an output that renders it (a create/update validation error returned to the client, or logs, telemetry, or crash reports that capture the changeset or error).</p>"}, {"base64": false, "type": "text/markdown", "value": "A resource must cloak an attribute that is not itself declared `sensitive? true`, and the plaintext must reach an output that renders it (a create/update validation error returned to the client, or logs, telemetry, or crash reports that capture the changeset or error)."}], "value": "A resource must cloak an attribute that is not itself declared sensitive? true, and the plaintext must reach an output that renders it (a create/update validation error returned to the client, or logs, telemetry, or crash reports that capture the changeset or error)."}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ash-project:ash_cloak:*:*:*:*:*:*:*:*", "versionEndExcluding": "0.4.0", "versionStartIncluding": "0.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "credits": [{"lang": "en", "type": "finder", "value": "Peter Ullrich"}, {"lang": "en", "type": "reporter", "value": "Peter Ullrich"}, {"lang": "en", "type": "remediation developer", "value": "Zach Daniel / Ash Project"}, {"lang": "en", "type": "coordinator", "value": "Jonatan M\u00e4nnchen / EEF"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ash-project ash_cloak allows anyone with access to logs, error trackers, or crash reports, or anyone who can trigger a validation error, to recover the plaintext of a field the library encrypts.</p>\n<p><code>AshCloak.Transformers.SetUpEncryption</code> removes each cloaked attribute from the action's <code>accept</code> list and adds an action argument that carries the plaintext into the encryption change. That argument is built with <code>sensitive?: attr.sensitive?</code>, inheriting the flag from the source attribute, so a cloaked attribute declared without <code>sensitive? true</code> produces a non-sensitive argument. It is the only place the cleartext value lives, and the one place Ash will not redact: it appears verbatim in <code>inspect(changeset)</code>, <code>Ash.Error.Invalid</code> and validation error messages, telemetry, <code>:sys</code> dumps, and error-tracker payloads. The generated encrypted attribute and decrypt calculation are already hardcoded sensitive.</p>\n<p>This issue affects ash_cloak: from 0.1.0 before 0.4.0.</p>"}, {"base64": false, "type": "text/markdown", "value": "Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ash-project ash_cloak allows anyone with access to logs, error trackers, or crash reports, or anyone who can trigger a validation error, to recover the plaintext of a field the library encrypts.\n\n`AshCloak.Transformers.SetUpEncryption` removes each cloaked attribute from the action's `accept` list and adds an action argument that carries the plaintext into the encryption change. That argument is built with `sensitive?: attr.sensitive?`, inheriting the flag from the source attribute, so a cloaked attribute declared without `sensitive? true` produces a non-sensitive argument. It is the only place the cleartext value lives, and the one place Ash will not redact: it appears verbatim in `inspect(changeset)`, `Ash.Error.Invalid` and validation error messages, telemetry, `:sys` dumps, and error-tracker payloads. The generated encrypted attribute and decrypt calculation are already hardcoded sensitive.\n\nThis issue affects ash_cloak: from 0.1.0 before 0.4.0."}], "value": "Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ash-project ash_cloak allows anyone with access to logs, error trackers, or crash reports, or anyone who can trigger a validation error, to recover the plaintext of a field the library encrypts.\n\nAshCloak.Transformers.SetUpEncryption removes each cloaked attribute from the action's accept list and adds an action argument that carries the plaintext into the encryption change. That argument is built with sensitive?: attr.sensitive?, inheriting the flag from the source attribute, so a cloaked attribute declared without sensitive? true produces a non-sensitive argument. It is the only place the cleartext value lives, and the one place Ash will not redact: it appears verbatim in inspect(changeset), Ash.Error.Invalid and validation error messages, telemetry, :sys dumps, and error-tracker payloads. The generated encrypted attribute and decrypt calculation are already hardcoded sensitive.\n\nThis issue affects ash_cloak: from 0.1.0 before 0.4.0."}], "impacts": [{"capecId": "CAPEC-37", "descriptions": [{"lang": "en", "value": "CAPEC-37 Retrieve Embedded Sensitive Data"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "baseScore": 2.1, "baseSeverity": "LOW", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-08-30T18:06:33.478Z"}, "references": [{"tags": ["vendor-advisory", "related"], "url": "https://github.com/ash-project/ash_cloak/security/advisories/GHSA-qp4v-vvrg-8ggx"}, {"tags": ["related"], "url": "https://cna.erlef.org/cves/CVE-2026-81322.html"}, {"tags": ["related"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-81322"}, {"tags": ["patch"], "url": "https://github.com/ash-project/ash_cloak/commit/ef49cfc832329fc8bc70ec6542a4dfff5dafd076"}], "source": {"discovery": "EXTERNAL"}, "title": "Cloaked plaintext leaks through a non-sensitive action argument in AshCloak"}}}

{}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.hex.pm", "cpes": ["cpe:2.3:a:ash-project:ash_cloak:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.AshCloak.Transformers.SetUpEncryption'"], "packageName": "ash_cloak", "packageURL": "pkg:hex/ash_cloak", "product": "ash_cloak", "programFiles": ["lib/ash_cloak/transformers/set_up_encryption.ex"], "programRoutines": [{"name": "'Elixir.AshCloak.Transformers.SetUpEncryption':rewrite_actions/2"}], "repo": "https://github.com/ash-project/ash_cloak", "vendor": "ash-project", "versions": [{"lessThan": "0.4.0", "status": "affected", "version": "0.1.0", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:ash-project:ash_cloak:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.AshCloak.Transformers.SetUpEncryption'"], "packageName": "ash-project/ash_cloak", "packageURL": "pkg:github/ash-project/ash_cloak", "product": "ash_cloak", "programFiles": ["lib/ash_cloak/transformers/set_up_encryption.ex"], "programRoutines": [{"name": "'Elixir.AshCloak.Transformers.SetUpEncryption':rewrite_actions/2"}], "repo": "https://github.com/ash-project/ash_cloak", "vendor": "ash-project", "versions": [{"lessThan": "ef49cfc832329fc8bc70ec6542a4dfff5dafd076", "status": "affected", "version": "f1595a77fdfa9bfc672f84c2f77feb9e7bf895fc", "versionType": "git"}]}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ash-project ash_cloak allows anyone with access to logs, error trackers, or crash reports, or anyone who can trigger a validation error, to recover the plaintext of a field the library encrypts.\n\nAshCloak.Transformers.SetUpEncryption removes each cloaked attribute from the action's accept list and adds an action argument that carries the plaintext into the encryption change. That argument is built with sensitive?: attr.sensitive?, inheriting the flag from the source attribute, so a cloaked attribute declared without sensitive? true produces a non-sensitive argument. It is the only place the cleartext value lives, and the one place Ash will not redact: it appears verbatim in inspect(changeset), Ash.Error.Invalid and validation error messages, telemetry, :sys dumps, and error-tracker payloads. The generated encrypted attribute and decrypt calculation are already hardcoded sensitive.\n\nThis issue affects ash_cloak: from 0.1.0 before 0.4.0."}], "id": "CVE-2026-81322", "lastModified": "2026-08-30T18:17:00.010", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}]}, "published": "2026-08-30T18:17:00.010", "references": [{"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://cna.erlef.org/cves/CVE-2026-81322.html"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/ash-project/ash_cloak/commit/ef49cfc832329fc8bc70ec6542a4dfff5dafd076"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/ash-project/ash_cloak/security/advisories/GHSA-qp4v-vvrg-8ggx"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://osv.dev/vulnerability/EEF-CVE-2026-81322"}], "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}]}

{}

{"created": "2026-08-30T19:30:17.115693+00:00", "updated": "2026-08-30T19:30:17.115699+00:00", "vendors": []}