CVE-2026-77970: Sensitive fields nested in embedded values are not redacted in AshPaperTrail versions
Cleartext Storage of Sensitive Information vulnerability in ash-project ashpapertrail allows an attacker with read access to the generated version resource to recover sensitive values nested inside embedded resources, unions, or lists.
sensitiveattributes :redact and :ignore only act on the tracked resource's top-level attributes. mayberedactchanges/3 and the stored-action-input path in AshPaperTrail.Resource.Changes.CreateNewVersion derive the sensitive set from the resource's own attributes and never descend into embedded, union, or list values, so a non-sensitive attribute or action argument that holds an embed with a sensitive? field (for example an accepted credentials embed carrying a token) is written to the version table in cleartext.
This issue affects ashpapertrail: from 0.3.0 before 0.7.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ash-project ash_paper_trailto a version that resolves this vulnerability.Fixed in 0.7.0
Event History
Frequently Asked Questions
Who can recover the exposed values?
An attacker needs read access to the generated version resource. The issue exposes sensitive fields only when they are nested inside embedded resources, unions, or lists that are stored through an otherwise non-sensitive tracked attribute or action argument.
Are top-level sensitive attributes protected?
Yes. The described redaction and ignore settings apply to the tracked resource's top-level attributes; the gap is that the sensitive-field handling does not descend into nested embedded, union, or list values.
Which deployments should be treated as affected?
AshPaperTrail versions from 0.3.0 before 0.7.0 are affected. Prioritize deployments that retain version records containing embeds, unions, or lists with sensitive nested fields, particularly where users or services can read the version resource.
How can I determine whether sensitive data may already have been stored in cleartext?
Review generated version records for non-sensitive attributes or stored action inputs that contain embedded values, unions, or lists. Check those nested structures for fields marked sensitive, such as a token in an accepted credentials embed, because those values may have been written to the version table in cleartext.