Cleartext Storage Vulnerability in Ash-Paper-Trail by Ash-Project

CVE-2026-77970

What is CVE-2026-77970?

The Ash-Paper-Trail component of the Ash-Project contains a vulnerability that allows attackers with read access to the generated version resource to retrieve sensitive nested values from embedded resources, unions, or lists in cleartext. Despite safeguards like sensitive_attributes :redact and :ignore, which apply only to the top-level attributes, the vulnerability allows non-sensitive attributes containing sensitive fields (e.g., tokens from accepted credentials) to be stored in version tables without encryption, exposing critical data.

References