CVE-2026-94206
Description
Use of Password Hash With Insufficient Computational Effort vulnerability in danielberkompas cloak_ecto and danielberkompas cloak allows an attacker who holds the hashed values and the configured secret to brute-force low-entropy plaintexts much faster than configured. The dump/1 callback that Cloak.Ecto.PBKDF2 (Cloak.Fields.PBKDF2 in cloak before the Ecto code moved to cloak_ecto) injects into a field module calls :pbkdf2.pbkdf2/4 with config[:size] in the iteration-count position. The :iterations setting is validated but never used. With the cloak_ecto defaults (iterations: 600_000, size: 32) each hash runs 32 PBKDF2 rounds instead of 600,000, so offline guessing of values such as email addresses costs about 18,750 times less than configured. This issue affects cloak_ecto: from 1.0.0-alpha.0 onward; cloak: from 0.7.0 before 1.0.0-alpha.0.
How to fix
- danielberkompas cloak1.0.0-alpha.0, 681c9702b7cd9afe0e5a840751ab009f550c69a9 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| danielberkompas cloak_ecto | 1.0.0-alpha.0, a8fa1642b02f1c445a1ee8794c9095eb0921f8f3 | — |
| danielberkompas cloak | 0.7.0 ≤ v < 1.0.0-alpha.0, 8699e6417a162c39d9f0ef63511bd23d3f38d1d2 ≤ v < 681c9702b7cd9afe0e5a840751ab009f550c69a9 | 1.0.0-alpha.0, 681c9702b7cd9afe0e5a840751ab009f550c69a9 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.