CVE-2026-81633: Unhandled KeyError in AshGraphql relay node resolution crashes queries via an unknown type segment
Improper Input Validation vulnerability in ash-project ashgraphql allows an unauthenticated client to crash a relay node(id: ...) query with an unhandled KeyError.
AshGraphql.Graphql.Resolver.resolvenode/2 decodes the client-supplied global ID with decoderelayid/1, which only base64-decodes the string and splits it on : without validating the type segment. The decoded type is passed straight to Map.fetch!(typetodomainandresourcemap, type). Because fetch! raises on a missing key, a relay ID whose type segment is a valid atom that is not a relay-exposed type aborts the resolver before its resolve/2 clauses and their rescue handlers run, so the error never becomes a GraphQL error and may expose a stacktrace. Common resource names are easy to guess. The fix uses Map.fetch/2 and returns an Invalid node id error for unknown types.
This issue affects ashgraphql: from 0.27.0 before 1.11.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ash-project ash_graphqlto a version that resolves this vulnerability.Fixed in 1.11.0 - Configuration
Update relay node resolution to use Map.fetch/2 instead of Map.fetch!/2 so unknown type segments return a GraphQL 'Invalid node id' error rather than raising an unhandled KeyError.
AshGraphql.Graphql.Resolver.resolve_node/2 Map.fetch!(type_to_domain_and_resource_map, type) = Map.fetch/2
Event History
Frequently Asked Questions
Who can trigger the crash?
Any unauthenticated client able to submit a relay node(id: ...) query can trigger it. The crafted global ID must decode to a type segment that is a valid atom but is not a relay-exposed type.
Are default deployments affected?
The issue is in relay node resolution, so deployments exposing the relay node(id: ...) query are affected. The provided data does not identify any additional configuration prerequisite.
What versions need remediation?
ash_graphql versions from 0.27.0 up to, but not including, 1.11.0 are affected. Version 1.11.0 changes unknown-type handling to return an Invalid node id error rather than raising.
What is the impact of a successful request?
The unhandled KeyError aborts the resolver instead of producing a GraphQL error. It can crash the query and may expose a stacktrace.