CVE-2026-78038: Job argument injection via :args overrides primary_key and tenant in AshOban
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ashoban allows a user whose input reaches the :args option of AshOban.buildtrigger/3 to retarget an update or destroy trigger at another record, including across tenants.
buildtrigger/3 builds the trusted job arguments with atom keys (:primarykey, :tenant, :actionarguments) and merges the caller's :args underneath so the trusted values win on collision. Because Oban job arguments round-trip through JSON, the caller's keys arrive as strings, so Map.merge sees no collision and both keys survive. When the job is persisted the JSON object is de-duplicated keeping the last (string) key, and the worker reads the caller's value. The documentation describes :args as unable to affect the action, so an application that forwards user input into it for uniqueness scoping is exposed to authorization bypass and tenant isolation breaks.
This issue affects ashoban: from 0.2.5 before 0.8.14.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ash-project ash_obanto a version that resolves this vulnerability.Fixed in 0.8.14 - Configuration
Change AshOban.build_trigger/3 so that caller-supplied :args cannot retarget update/destroy triggers by overriding :primary_key or :tenant when building persisted job arguments.
ash_oban AshOban.build_trigger/3 :args merge behavior = Do not allow caller-provided :args to override trusted job arguments such as :primary_key and :tenant (reject or deep-merge without overwriting collisions)
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Applications are exposed if untrusted user-controlled input can reach the :args option of AshOban.build_trigger/3, including when :args is used for uniqueness scoping. The impact can include retargeting update or destroy triggers to another record and crossing tenant boundaries.
What does an attacker need to exploit this issue?
An attacker needs control over values passed into :args for a call to AshOban.build_trigger/3. They can supply string keys such as "primary_key" or "tenant", which survive the merge and later override the trusted values after the job arguments round-trip through JSON.
Which versions are affected?
ash_oban versions from 0.2.5 before 0.8.14 are affected.
What can be done if upgrading is not immediately possible?
Do not forward user-controlled input into :args. Ensure any :args values are application-controlled and reject or remove string keys that could target action arguments, including "primary_key" and "tenant".