CVE-2026-86338: Ash Package Information Disclosure via Unfiltered Calculations and Aggregates
Summary
CVE-2026-86338: Ash field_policies are documented to protect against filter-based information disclosure: when a field the actor may not see is referenced in a filter, it is replaced with an expression that evaluates to nil, so a filter... Affects ash across 2 version ranges.
>= 0b6d93c7c4637280b46ae66ea1d2eaf013701238, < b3d4503241f3deacb5ceb955e10a4fa927da0f67
>= 2.11.0-rc.0, < 3.33.4
Fixed in 3.33.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Ash package is an open-source framework designed for building APIs in Elixir. It provides a robust set of features for managing resources, including field policies that restrict access to sensitive data. However, a vulnerability has been identified that allows unauthorized access to certain calculations and aggregates, undermining the intended security measures.
Vulnerability Detail
The vulnerability arises from the Ash field policies not adequately filtering nil values for calculations and aggregates. When a user-supplied filter references a calculation or aggregate, it bypasses the intended restrictions, allowing unauthorized actors to infer sensitive information. This can lead to information disclosure, as attackers can probe the system to learn values they should not have access to, effectively turning the filter into an oracle. The issue affects versions of Ash from 2.11.0-rc.0 up to, but not including, 3.33.4.
How To Fix
Latest published version: 3.37.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.33.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid exposing filters on calculations and aggregates to actors who are denied access to these fields. This can be done by implementing stricter access controls in your API endpoints until the package is updated.
Conclusion
CVE-2026-86338 represents a significant security risk for applications using the Ash package, allowing unauthorized access to sensitive data through unfiltered calculations and aggregates. It is crucial to update to the patched version 3.33.4 or later to mitigate this risk.
See every vulnerability recorded for ash →
FAQ
CVE-2026-86338 is a vulnerability in the Ash package that allows unauthorized access to sensitive calculations and aggregates due to insufficient filtering.
If your application uses Ash and exposes filters on calculations or aggregates, unauthorized users may infer sensitive information, leading to potential data breaches.
The vulnerability affects Ash versions from 2.11.0-rc.0 up to, but not including, 3.33.4.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 6.0, indicating a moderate level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for ash.
