CVE-2026-78693: Incomplete redaction re-attaches the original error path in AshGraphql, leaking internal field names
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashgraphql allows a remote client to read internal field names that an application configured its errorhandler to redact.
In AshGraphql.Errors, each error is passed to the configured errorhandler and the returned map is merged with the pre-handler path via Map.putnew(handled, :path, path). Because putnew defers to the handler only when the handler itself set :path, a sanitizing handler that returns a fresh map or deletes :path has that decision reverted. The re-injected path comes from builderrorpath/5, which falls back to raw internal Ash attribute and argument names when no fieldnames mapping is configured. A validation failure on a non-exposed or nested field therefore returns internal names in the GraphQL error path, defeating the application's redaction.
This issue affects ashgraphql: from 1.9.0 before 1.11.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ash-project ash_graphqlto a version that resolves this vulnerability.Fixed in 1.11.0
Event History
Frequently Asked Questions
Which applications are exposed to internal field-name disclosure?
Applications using ash_graphql versions from 1.9.0 before 1.11.0 are affected when they rely on an error_handler to redact or remove GraphQL error paths. Disclosure is possible when build_error_path/5 falls back to raw Ash attribute or argument names because no field_names mapping is configured.
What does an attacker need to do to trigger the disclosure?
A remote client needs to cause a validation failure involving a non-exposed or nested field. The resulting GraphQL error path can reveal internal Ash field or argument names.
Is configuring an error_handler to remove the path sufficient mitigation?
No. If the handler returns a fresh map or deletes :path, AshGraphql re-attaches the pre-handler path through Map.put_new, unless the handler explicitly sets its own :path value.
What can be done before upgrading?
Configure field_names mappings so error paths do not fall back to raw internal Ash attribute and argument names. An error_handler can also explicitly set :path, rather than merely deleting it, to prevent the pre-handler path from being inserted.