CVE-2026-70395

{
  "id": "CVE-2026-70395",
  "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
  "published": "2026-08-09T19:17:02.547",
  "lastModified": "2026-10-24T16:10:00.153",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash allows an attacker to forge a relationship to a record they cannot name, and to recover the secret value used to look it up.\n\nWhen manage_relationship is used with on_lookup: :relate on a belongs_to relationship, the client-supplied lookup value is passed to Ash.Query.filter/2 without being cast to the attribute type. A nested map submitted where a scalar is expected is therefore interpreted as a filter predicate rather than a literal, so a lookup for a specific record becomes a query for any record matching a condition. The same path omits Ash.Query.limit(1), leaving Ash.read_one/2 able to distinguish no match from one match from several, which turns comparison predicates into an oracle for the lookup value. Authorization is unaffected; the destination read policy still applies.\n\nThis issue affects ash: from 1.52.0-rc.11 before 3.31.1."
    },
    {
      "lang": "es",
      "value": "vulnerabilidad de neutralización incorrecta de elementos especiales en la lógica de consulta de datos en ash-project ash permite a un atacante forjar una relación con un registro que no pueden nombrar, y recuperar el valor secreto utilizado para buscarlo.\n\nCuando manage_relationship se utiliza con on_lookup: :relate en una relación belongs_to, el valor de búsqueda proporcionado por el cliente se pasa a Ash.Query.filter/2 sin ser convertido al tipo de atributo. Un mapa anidado enviado donde se espera un escalar se interpreta, por lo tanto, como un predicado de filtro en lugar de un literal, por lo que una búsqueda de un registro específico se convierte en una consulta para cualquier registro que coincida con una condición. La misma ruta omite Ash.Query.limit(1), dejando a Ash.read_one/2 capaz de distinguir ninguna coincidencia de una coincidencia de varias, lo que convierte los predicados de comparación en un oráculo para el valor de búsqueda. La autorización no se ve afectada; la política de lectura de destino sigue aplicándose.\n\nEste problema afecta a ash: desde 1.52.0-rc.11 antes de 3.31.1."
    }
  ],
  "affected": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "affectedData": [
        {
          "vendor": "ash-project",
          "product": "ash",
          "defaultStatus": "unaffected",
          "collectionURL": "https://repo.hex.pm",
          "packageName": "ash",
          "cpes": [
            "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "'Elixir.Ash.Actions.ManagedRelationships'",
            "'Elixir.Ash.Changeset'"
          ],
          "programFiles": [
            "lib/ash/actions/managed_relationships.ex",
            "lib/ash/changeset/changeset.ex"
          ],
          "programRoutines": [
            {
              "name": "'Elixir.Ash.Actions.ManagedRelationships':setup_managed_belongs_to_relationships/3"
            },
            {
              "name": "'Elixir.Ash.Changeset':manage_relationship/4"
            }
          ],
          "repo": "https://github.com/ash-project/ash",
          "packageURL": "pkg:hex/ash",
          "versions": [
            {
              "version": "1.52.0-rc.11",
              "lessThan": "3.31.1",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "ash-project",
          "product": "ash",
          "defaultStatus": "unaffected",
          "collectionURL": "https://github.com",
          "packageName": "ash-project/ash",
          "cpes": [
            "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "'Elixir.Ash.Actions.ManagedRelationships'",
            "'Elixir.Ash.Changeset'"
          ],
          "programFiles": [
            "lib/ash/actions/managed_relationships.ex",
            "lib/ash/changeset/changeset.ex"
          ],
          "programRoutines": [
            {
              "name": "'Elixir.Ash.Actions.ManagedRelationships':setup_managed_belongs_to_relationships/3"
            },
            {
              "name": "'Elixir.Ash.Changeset':manage_relationship/4"
            }
          ],
          "repo": "https://github.com/ash-project/ash",
          "packageURL": "pkg:github/ash-project/ash",
          "versions": [
            {
              "version": "571c138140e71cea24005189f45d7a63c8d2ed20",
              "lessThan": "09f42593035bceb0f6153dd7ee45cc49d108300a",
              "versionType": "git",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 2.1,
          "baseSeverity": "LOW",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "LOW",
          "vulnIntegrityImpact": "LOW",
          "vulnAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-10T15:56:57.175785Z",
          "id": "CVE-2026-70395",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-943"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://cna.erlef.org/cves/CVE-2026-70395.html",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/ash-project/ash/commit/09f42593035bceb0f6153dd7ee45cc49d108300a",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/ash-project/ash/security/advisories/GHSA-vvp6-3wv6-833j",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-70395",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    }
  ]
}