CVE-2026-82759: Ash Auth Audit Log IP Privacy Hash Reversible via Precomputed Table

Vulnerability Overview Vulnerability Title: Audit log IP privacy mode is reversible: unsalted SHA-256 with a publicly available constant salt CVE ID: CVE-2026-82759 Severity: Low (CVSS v3.1 Base Score 2.3) Description: The privacy mode does not provide true anonymization. It computes an unsalted SHA-256 (where the salt is a constant publicly exposed in the library source code) and truncates the result to 64 bits. Given the small IPv4 address space and the fact that SHA-256 is a one-way function, attackers can offline pre-compute a complete lookup table to recover the source IP addresses of all logged authentication events. Affected Versions: Fixed Version: ( is also affected, fixed in ) Scope of Impact Affected Configurations: - is enabled and set to (default) - is set to (default) - Deployments without or configured are affected Impact: - Any entity capable of reading the audit storage (DBAs, SIEM users, audit log readers) can recover source IPs via offline pre-computation - No attacker-controlled trigger conditions; not remotely exploitable and not attacker-triggered - Not exposed by default: defaults to ; only deployments explicitly selecting are affected - No leakage of credentials or authentication information; only IP addresses are exposed - Historical data already written cannot be remediated via upgrade (the salt is hardcoded at the time of writing) Remediation 1. Set an explicit secret salt (Immediate Mitigation): Using a high-entropy salt effectively changes the salt, making pre-computation infeasible. 2. Or switch to or : - : Truncates IP addresses, suitable for scenarios where distinguishing individual addresses is not required. - : Completely excludes the IP field. 3. Remediation for written data: - Upgrading cannot fix historical rows (the salt is hardcoded at the time of writing) - Operators should treat IP fields as compromised and perform cleanup or overwriting - This also applies to backups, SIEM ingestion, support bundles, and exports 4. Root Fix (4.15.0 / 5.0.0-rc.14): - Replaces salted hashing with HMAC: - Removes constant fallback: startup fails if the salt is not configured - Configuration moved to the consumer namespace: the salt is read from application configuration, requiring no additional configuration - Installer provides the salt: after validation, mode uses the selected value POC / Relevant Code Core Vulnerable Code ( ): Corrected Construction After Fix:

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-82759: Ash Auth Audit Log IP Privacy Hash Reversible via Precomputed Table

More from this source