CVE-2026-70395
Description
Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash allows an attacker to forge a relationship to a record they cannot name, and to recover the secret value used to look it up. When manage_relationship is used with on_lookup: :relate on a belongs_to relationship, the client-supplied lookup value is passed to Ash.Query.filter/2 without being cast to the attribute type. A nested map submitted where a scalar is expected is therefore interpreted as a filter predicate rather than a literal, so a lookup for a specific record becomes a query for any record matching a condition. The same path omits Ash.Query.limit(1), leaving Ash.read_one/2 able to distinguish no match from one match from several, which turns comparison predicates into an oracle for the lookup value. Authorization is unaffected; the destination read policy still applies. This issue affects ash: from 1.52.0-rc.11 before 3.31.1.
How to fix
- ash-project ash3.31.1, 09f42593035bceb0f6153dd7ee45cc49d108300a or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ash-project ash | 1.52.0-rc.11 ≤ v < 3.31.1, 571c138140e71cea24005189f45d7a63c8d2ed20 ≤ v < 09f42593035bceb0f6153dd7ee45cc49d108300a | 3.31.1, 09f42593035bceb0f6153dd7ee45cc49d108300a |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.