Sensitive Information Exposure in Ash Project's Cloak Library
CVE-2026-81322

2.1LOW

Key Information:

Vendor

Ash-project

Status
Ash Cloak
Vendor
CVE Published:
30 August 2026

What is CVE-2026-81322?

The Ash Project's Cloak library contains a vulnerability that allows unauthorized actors to recover plaintext data due to improper handling of sensitive attributes during encryption processes. The issue arises when a cloaked attribute is incorrectly marked as non-sensitive, leading to the exposure of sensitive information in logs, error messages, and telemetry data. This vulnerability affects versions of ash_cloak from 0.1.0 to 0.4.0, where the cleartext values are visible in various outputs that do not redact sensitive data.

Affected Version(s)

ash_cloak 0.1.0 < 0.4.0

ash_cloak f1595a77fdfa9bfc672f84c2f77feb9e7bf895fc

References

https://github.com/ash-project/ash_cloak/security/advisor...
vendor-advisoryrelated
https://cna.erlef.org/cves/CVE-2026-81322.html
related
https://osv.dev/vulnerability/EEF-CVE-2026-81322
related

CVSS V4

Score:
2.1
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Peter Ullrich
Peter Ullrich
Zach Daniel / Ash Project
Jonatan Männchen / EEF
.