{"id":"EEF-CVE-2026-81322","summary":"Cloaked plaintext leaks through a non-sensitive action argument in AshCloak","details":"## Summary\n\nExposure of Sensitive Information to an Unauthorized Actor vulnerability in ash-project ash_cloak allows anyone with access to logs, error trackers, or crash reports, or anyone who can trigger a validation error, to recover the plaintext of a field the library encrypts.\n\n`AshCloak.Transformers.SetUpEncryption` removes each cloaked attribute from the action's `accept` list and adds an action argument that carries the plaintext into the encryption change. That argument is built with `sensitive?: attr.sensitive?`, inheriting the flag from the source attribute, so a cloaked attribute declared without `sensitive? true` produces a non-sensitive argument. It is the only place the cleartext value lives, and the one place Ash will not redact: it appears verbatim in `inspect(changeset)`, `Ash.Error.Invalid` and validation error messages, telemetry, `:sys` dumps, and error-tracker payloads. The generated encrypted attribute and decrypt calculation are already hardcoded sensitive.\n\nThis issue affects ash_cloak: from 0.1.0 before 0.4.0.\n\n## Configurations\n\nA resource must cloak an attribute that is not itself declared `sensitive? true`, and the plaintext must reach an output that renders it (a create/update validation error returned to the client, or logs, telemetry, or crash reports that capture the changeset or error).","aliases":["CVE-2026-81322","GHSA-qp4v-vvrg-8ggx"],"modified":"2026-09-08T19:45:02.985176518Z","published":"2026-08-30T18:06:33.478Z","database_specific":{"cwe_ids":["CWE-200"],"capec_ids":["CAPEC-37"],"cpe_ids":["cpe:2.3:a:ash-project:ash_cloak:*:*:*:*:*:*:*:*"]},"references":[{"type":"ADVISORY","url":"https://github.com/ash-project/ash_cloak/security/advisories/GHSA-qp4v-vvrg-8ggx"},{"type":"WEB","url":"https://cna.erlef.org/cves/CVE-2026-81322.html"},{"type":"FIX","url":"https://github.com/ash-project/ash_cloak/commit/ef49cfc832329fc8bc70ec6542a4dfff5dafd076"},{"type":"PACKAGE","url":"https://hex.pm/packages/ash_cloak"}],"affected":[{"package":{"name":"ash_cloak","ecosystem":"Hex","purl":"pkg:hex/ash_cloak"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.1.0"},{"fixed":"0.4.0"}]}],"versions":["0.1.0","0.1.1","0.1.2","0.1.3","0.1.4","0.1.5","0.1.6","0.1.7","0.2.0","0.2.1","0.3.0","0.3.1"],"database_specific":{"source":"https://cna.erlef.org/osv/EEF-CVE-2026-81322.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/ash-project/ash_cloak","events":[{"introduced":"f1595a77fdfa9bfc672f84c2f77feb9e7bf895fc"},{"fixed":"ef49cfc832329fc8bc70ec6542a4dfff5dafd076"}]}],"versions":["v0.3.1","v0.3.0","v0.2.1","v0.2.0","v0.1.7","v0.1.6","v0.1.5","v0.1.4","v0.1.3","v0.1.2","v0.1.1","v0.1.0"],"database_specific":{"source":"https://cna.erlef.org/osv/EEF-CVE-2026-81322.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}],"credits":[{"name":"Peter Ullrich","type":"FINDER"},{"name":"Peter Ullrich","type":"REPORTER"},{"name":"Zach Daniel / Ash Project","type":"REMEDIATION_DEVELOPER"},{"name":"Jonatan Männchen / EEF","type":"COORDINATOR"}]}