CVE-2026-78699: AshPostgres Unchecked Return Value Vulnerability Leading to Cross-Tenant Data Access
Summary
CVE-2026-78699: rename_tenant returns :ok on a failed rename, enabling cross-tenant access in AshPostgres. Affects ash_postgres across 2 version ranges.
>= 0.25.0, < 2.13.0
>= 03510dae24020e302558ef947be7ea874a9ce756, < 8544ab15fe45784553c2d2da8ee1a388eee0174b
Fixed in 2.13.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
AshPostgres is a library that facilitates schema-based multitenancy in applications using PostgreSQL. It allows developers to manage multiple tenants within a single database by isolating their data in separate schemas. This capability is crucial for applications that serve multiple clients while ensuring data privacy and security. However, a vulnerability has been identified that can compromise this isolation, allowing unauthorized access to tenant data.
Vulnerability Detail
The vulnerability arises from an unchecked return value in the AshPostgres.MultiTenancy.rename_tenant function. When a tenant attempts to rename their schema to a name that already exists, the function executes an ALTER SCHEMA ... RENAME TO ... command without properly handling the result. If the rename fails due to a schema collision, insufficient privileges, or a lock timeout, the function still returns :ok, misleading the caller into believing the operation was successful. Consequently, the tenant's record is updated to point to another tenant's schema, allowing unauthorized access to that tenant's data. This issue affects AshPostgres versions from 0.25.0 to before 2.13.0.
How To Fix
Latest published version: 2.15.1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.13.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid allowing users to rename tenants to names that may collide with existing tenant schemas. Implement validation checks to ensure that the new tenant name is unique before attempting to rename the schema.
Conclusion
CVE-2026-78699 presents a significant risk to applications using AshPostgres for multitenancy, allowing unauthorized data access due to improper handling of schema renaming. It is crucial to update to the patched version 2.13.0 or later to mitigate this vulnerability. Additionally, implementing validation checks can help prevent exploitation until an update can be applied.
See every vulnerability recorded for ash_postgres →
FAQ
CVE-2026-78699 is a vulnerability in the AshPostgres library that allows unauthorized access to tenant data due to an unchecked return value during schema renaming.
The vulnerability affects AshPostgres versions from 0.25.0 to before 2.13.0.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 7.2, indicating a high severity level.
If you cannot update the package immediately, implement validation checks to prevent users from renaming tenants to existing schema names as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for ash_postgres.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.