CVE-2026-78038

Name of the Vulnerable Software and Affected Versions ash oban versions 0.2.5 through 0.8.13

Description An Improperly Controlled Modification of Dynamically-Determined Object Attributes allows a user to retarget an update or destroy trigger at another record, potentially crossing tenant boundaries. This occurs when untrusted input reaches the :args option of the build trigger() function. The function merges trusted job arguments using atom keys, but because arguments are processed through JSON, caller keys arrive as strings. This prevents collisions during the merge process, allowing the caller's string keys to persist and be read by the worker during job persistence. Consequently, applications forwarding user input into :args for uniqueness scoping are susceptible to authorization bypass and tenant isolation failure.

Recommendations Update ash oban to version 0.8.14 or later. Avoid passing untrusted input into the :args option of the build trigger() function.