AshSql Cross-Tenant Info Leak (CVE-2025-81318) Analysis & Fix

Summary of the AshSql Cross-Tenant Information Leakage Vulnerability Vulnerability Overview Vulnerability Name: When performs aggregation on a query, it discards the query prefix (tenant prefix), potentially allowing schema-based multi-tenant applications to read aggregated values from other tenants. CVE ID: CVE-2025-81318 Severity: Low (CVSS 2.1/10) Affected Versions: < 0.7.1 Fixed Version: 0.7.1 Publisher: zachdaniel (GHSA-wwb1-58rc-8fh3) Impact Scope Any application using AshPostgres schema-based multi-tenancy that aggregates queries may return / / aggregated values from other tenants. Trigger Condition: When the aggregation is based on a query, rebuilds the query from scratch and loses the , causing reads to occur against tables in the schema, resulting in cross-tenant information leakage. Remediation Upgrade to 0.7.1 or a later version. Fix Method: Instead of rebuilding the query from scratch, the existing query is now wrapped as a subquery, thereby preserving the tenant prefix. POC Code (Full Extraction) ```elixir Reproduction: schema tenant aggregation based on a distinct Ash query. Primary keys/foreign keys exist in both public and tenant schemas, but with different values. After the prefix is discarded, values in public become visible in the returned sum. previous_no_warn_undefined = Code.compiler_options[:previous_no_warn_undefined] Code.put_compiler_option(:no_warn_undefined) Ecto.Adapters.SQL.query!( "Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters.SQL.query!(Ecto.Adapters

Goal Reached Thanks to every supporter — we hit 100%!

AshSql Cross-Tenant Info Leak (CVE-2025-81318) Analysis & Fix

More from this source