CVE-2026-70395

Name of the Vulnerable Software and Affected Versions ash-project ash versions 1.52.0-rc.11 through 3.31.0

Description Improper Neutralization of Special Elements in Data Query Logic allows an attacker to forge a relationship to a record they cannot name and recover the secret value used for lookup. This occurs when manage relationship is used with on lookup: :relate on a belongs to relationship, as the client-supplied lookup value is passed to Ash.Query.filter/2 without being cast to the attribute type. Consequently, a nested map submitted instead of a scalar is interpreted as a filter predicate rather than a literal, transforming a specific record lookup into a query for any record matching a condition. Additionally, the omission of Ash.Query.limit(1) allows Ash.read one/2 to distinguish between no match, one match, and several matches, creating an oracle for the lookup value. Authorization remains unaffected as the destination read policy still applies.

Recommendations Update ash-project ash to version 3.31.1 or later.