Log Forgery in Ash Authentication Password Reset (CVE-2026-84522)

Vulnerability Overview Title: Log Forgery via Unescaped Password Reset Identity Fields in PostgreSQL (including null bytes) Type: Log Forgery Severity: Medium (CVSS 5.3/10) CVE: CVE-2026-84522 Root Cause: inserts and directly into the message without escaping newlines and null bytes ( ). An attacker can inject newlines to forge log lines, or inject null bytes, causing PostgreSQL to reject the encoding and failing the log write operation. Affected Scope Affected Versions: Fixed Version: Affected Data Layers: PostgreSQL (null byte trigger); SQLite and MySQL tolerate embedded null bytes and are not affected. Affected Configurations: - 5.0 Release Candidates (v5.0.0-rc.0 to v5.0-rc.13): The default reset action is a generic action; the sink is triggered only on read-only paths. - 4.x (v4.2.0 to v4.14.2): Reachability depends on configuration, such as default reset action being read-only, and configured with . Impact: An unauthenticated caller can forge arbitrary log lines, making log entries appear as if they originated from a different severity level or component. This can pollute the event timeline, mislead responders, and inject content into downstream systems (SIEM ingestion pipelines, alerting rules). It is not a data or credential leak, does not impact availability, and is not universally triggerable (null byte trigger is specific to PostgreSQL). Remediation Core Fix: Reject or escape control characters (newlines, null bytes) in identity fields at the controller or validation layer. Code Fix Example: Other Mitigations: - Mark pre-generated reset path entries for integrity purposes. - Use a structured logging backend (encode the message as a single field). - Apply the same handling to 4.x log sites for consistency. - More broadly, all user-controlled values inserted into log messages should be escaped via . POC / Exploit Code

Goal Reached Thanks to every supporter — we hit 100%!

Log Forgery in Ash Authentication Password Reset (CVE-2026-84522)

More from this source