CVE-2026-82367

Name of the Vulnerable Software and Affected Versions ash graphql versions 1.4.0 through 1.10.x

Description An issue exists where resolved records from one subscription may be delivered to a different subscriber's topic. This occurs because the do send/5 function in AshGraphql.Subscription.Batcher retrieves the resolved batch from the process dictionary using Process.get(:batch resolved) and deletes it unconditionally. When using :backpressure sync or :noproc fallbacks, do send/5 runs inline. If a resolver within an outer do send/5 call triggers another synchronous Ash notification, the inner call retrieves the outer run's value from :batch resolved, publishes it to the inner topic (which may belong to a different actor or tenant), and deletes the key, leaving the outer run with nothing to publish.

Recommendations Update ash graphql to version 1.11.0 or later.