Improper Input Validation in Ash GraphQL Affects Ash Project

CVE-2026-81633

What is CVE-2026-81633?

An improper input validation vulnerability in Ash GraphQL allows an unauthenticated client to trigger a Node crash via a malformed relay ID query. The vulnerability stems from the handling of input that does not properly validate the type segment extracted from the decoded global ID, leading to an unhandled KeyError. This can potentially expose internal stack traces without raising a proper GraphQL error, implicating security risks. Affected versions of Ash GraphQL from 0.27.0 before 1.11.0 are vulnerable, but a fix has been implemented to return an 'Invalid node id' error for unrecognized types, enhancing overall security.

References