Data Exposure Vulnerability in Ash-GraphQL from Ash-Project
CVE-2026-82367

2.3LOW

Key Information:

Vendor

Ash-project

Status
Ash Graphql
Vendor
CVE Published:
30 August 2026

What is CVE-2026-82367?

The Ash-GraphQL library contains a vulnerability that permits the exposure of resolved subscription records to incorrect subscribers. This issue arises when the function AshGraphql.Subscription.Batcher.do_send/5 accesses resolved batches from a shared process dictionary and fails to properly isolate them between different subscription processes. In certain fallback scenarios, this can lead to the wrong subscriber receiving data intended for another session. The underlying problem stems from a lack of namespacing for the keys in the process dictionary, allowing one run's records to be mistakenly available to another. A recommended fix has been implemented to ensure isolation of data across different sessions.

Affected Version(s)

ash_graphql 1.4.0 < 1.11.0

ash_graphql 3cb2c9870d050c7c4bba6c211aaed97d732f7e81

References

https://github.com/ash-project/ash_graphql/security/advis...
vendor-advisoryrelated
https://cna.erlef.org/cves/CVE-2026-82367.html
related
https://osv.dev/vulnerability/EEF-CVE-2026-82367
related

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Peter Ullrich
Peter Ullrich
Zach Daniel / Ash Project
Jonatan Männchen / EEF
.