CVE-2026-78038: Job Argument Injection Vulnerability in ash_oban
Summary
CVE-2026-78038: Job argument injection via :args overrides primary_key and tenant in AshOban. Affects ash_oban across 2 version ranges.
>= 0.2.5, < 0.8.14
>= ce079229ecdf0d323da2b554f30fc569e54660f0, < da2d81e1e8e1dcc3e6ec8587cdb4f273575ffca3
Fixed in 0.8.14. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ash_oban is a library designed to facilitate job scheduling and processing within the Ash framework. It allows developers to create background jobs that can be executed asynchronously. The library provides features such as job retries, scheduling, and monitoring, making it a valuable tool for applications that require background processing. However, a vulnerability has been identified that allows untrusted user input to manipulate job arguments, potentially leading to unauthorized access and tenant isolation breaches.
Vulnerability Detail
The vulnerability arises from the improper handling of user input in the :args option of the AshOban.build_trigger/3 function. When a user provides input that reaches this option, it can override trusted job arguments such as :primary_key and :tenant. This occurs because the merging of the caller's input with trusted values does not account for string versus atom key types, allowing both to coexist. As a result, an attacker can manipulate job arguments to target different records, potentially across different tenants, leading to significant security risks including authorization bypass.
How To Fix
Latest published version: 0.10.2 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.8.14
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid passing untrusted user input directly into the :args option of AshOban.build_trigger/3. Instead, sanitize or validate the input before it reaches this function to prevent potential injection attacks.
Conclusion
CVE-2026-78038 presents a significant security risk in the ash_oban library, allowing attackers to manipulate job arguments through untrusted input. It is crucial for developers using this library to update to the patched version 0.8.14 to protect their applications from potential exploitation. Additionally, employing input validation can serve as a temporary measure to mitigate risks.
See every vulnerability recorded for ash_oban →
FAQ
CVE-2026-78038 is a vulnerability in the ash_oban library that allows job argument injection, potentially leading to unauthorized access and tenant isolation breaches.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability affects ash_oban versions from 0.2.5 up to, but not including, 0.8.14.
The CVSS score of this vulnerability is 5.9, indicating a moderate level of severity.
If an immediate update is not possible, implement input validation or sanitization as a workaround to mitigate the risk until you can upgrade to the patched version.
Related vulnerabilities
Recent vulnerabilities recorded for ash_oban.
