CVE-2026-81316: AshSql Aggregate Filter Conflation Vulnerability
Summary
CVE-2026-81316: Same-named aggregates with differing filters are conflated in AshSql. Affects ash_sql across 2 version ranges.
>= 0.1.0, < 0.7.1
>= dd092ed273dec7bd2194352f24a39229fc8ae68b, < 4b95468e5434a3526571414219719c9518be6694
Fixed in 0.7.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
AshSql is a powerful SQL query builder for Elixir applications, designed to facilitate the construction and execution of SQL queries in a more structured and manageable way. It allows developers to define queries using Elixir syntax, making it easier to work with databases. However, a significant vulnerability has been identified in versions prior to 0.7.1, where aggregates with the same name but different filters can lead to unauthorized data exposure.
Vulnerability Detail
The vulnerability arises from an incorrect authorization mechanism in AshSql, where aggregates with identical names but differing filters are conflated. This means that a user can inadvertently access aggregate values that should have been restricted by a more stringent filter, potentially exposing sensitive data across authorization or tenancy boundaries. The issue is rooted in the way AshSql compares aggregate queries, treating them as identical unless both the filter and sort differ. Since aggregates typically do not carry a sort, this flaw allows for the unintended sharing of aggregate values.
How To Fix
Latest published version: 0.8.3 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.7.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using aggregates with the same name in contexts where different filters are applied. Ensure that aggregates are uniquely named or implement additional checks to validate the context in which they are used.
Conclusion
The CVE-2026-81316 vulnerability in AshSql poses a risk of unauthorized data exposure due to the conflation of aggregates with the same name but different filters. It is crucial to update to version 0.7.1 or later to mitigate this risk. Implementing unique naming conventions for aggregates can serve as a temporary workaround.
See every vulnerability recorded for ash_sql →
FAQ
CVE-2026-81316 is a vulnerability in the AshSql package that allows unauthorized access to aggregate values due to conflated filters.
Versions of AshSql from 0.1.0 up to, but not including, 0.7.1 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
If you cannot update, consider implementing unique naming for aggregates or additional validation checks to prevent unauthorized access.
The CVSS score for this vulnerability is 2.1, indicating a low severity level.
Related vulnerabilities
Recent vulnerabilities recorded for ash_sql.
