CVE-2026-81322

Name of the Vulnerable Software and Affected Versions ash cloak versions 0.1.0 through 0.3.x

Description An issue in the AshCloak.Transformers.SetUpEncryption function allows unauthorized actors to recover the plaintext of encrypted fields. This occurs when a cloaked attribute is declared without sensitive? true, causing the resulting action argument to be treated as non-sensitive. Consequently, the cleartext value is not redacted and appears verbatim in inspect(changeset), Ash.Error.Invalid and validation error messages, telemetry, :sys dumps, and error-tracker payloads. This information can be accessed by anyone with access to logs, error trackers, crash reports, or those capable of triggering a validation error.

Recommendations Update ash cloak to version 0.4.0 or later. As a temporary mitigation, ensure all cloaked attributes are explicitly declared with sensitive? true to ensure the plaintext is redacted in logs and error messages.