Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-70395— Predicate injection in manage_relationship belongs_to lookup discloses secret lookup keys in Ash

Quick assessment

Affected
ash-project ash
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Ash Framework是Ash Framework组织的一款基于Elixir的开发框架。 Ash Framework 1.52.0-rc.11至3.31.1之前版本存在输入验证错误漏洞，该漏洞源于数据查询逻辑中特殊元素中和不当，客户端提供的查找值未经类型转换直接传递给过滤器，可能允许攻击者伪造关系并恢复用于查找的秘密值。

CVSS 2.1 · Low EPSS 0.14% · P3

Possible ATT&CK Techniques 1 AI

T1115 · Clipboard Data

Affected Version Matrix 2

VendorProduct Version RangeStatus
ash-project ash 1.52.0-rc.11< 3.31.1 affected
571c138140e71cea24005189f45d7a63c8d2ed20< 09f42593035bceb0f6153dd7ee45cc49d108300a affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-70395

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Predicate injection in manage_relationship belongs_to lookup discloses secret lookup keys in Ash
Source: CVE Program / CVE List V5
Vulnerability Description
Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash allows an attacker to forge a relationship to a record they cannot name, and to recover the secret value used to look it up. When manage_relationship is used with on_lookup: :relate on a belongs_to relationship, the client-supplied lookup value is passed to Ash.Query.filter/2 without being cast to the attribute type. A nested map submitted where a scalar is expected is therefore interpreted as a filter predicate rather than a literal, so a lookup for a specific record becomes a query for any record matching a condition. The same path omits Ash.Query.limit(1), leaving Ash.read_one/2 able to distinguish no match from one match from several, which turns comparison predicates into an oracle for the lookup value. Authorization is unaffected; the destination read policy still applies. This issue affects ash: from 1.52.0-rc.11 before 3.31.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
数据查询逻辑中特殊元素的不当中和
Source: CVE Program / CVE List V5
Vulnerability Title
Ash Framework 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Ash Framework是Ash Framework组织的一款基于Elixir的开发框架。 Ash Framework 1.52.0-rc.11至3.31.1之前版本存在输入验证错误漏洞，该漏洞源于数据查询逻辑中特殊元素中和不当，客户端提供的查找值未经类型转换直接传递给过滤器，可能允许攻击者伪造关系并恢复用于查找的秘密值。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
ash-project ash 1.52.0-rc.11 ~ 3.31.1 cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*
ash-project ash 571c138140e71cea24005189f45d7a63c8d2ed20 ~ 09f42593035bceb0f6153dd7ee45cc49d108300a cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-70395

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-70395

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-70395 (1)

Vendor Advisories for CVE-2026-70395 (3)

IV. Related Vulnerabilities

Same product: ash
Same vendor: ash-project
Same weakness: CWE-943

V. Comments for CVE-2026-70395

No comments yet

Leave a comment