Executive brief
ash_oban is an Elixir library for integrating Ash framework applications with the Oban job queue system. A vulnerability in the build_trigger function allows attackers to modify job arguments by exploiting JSON round-trip behavior, potentially redirecting database operations (updates or destroys) to unintended records, including across tenant boundaries. This breaks authorization controls and multi-tenant data isolation.
Technical details
The vulnerability is an improper attribute modification flaw (CWE-915) in ash_oban's build_trigger/3 function. The root cause is a key collision issue during JSON serialization: trusted job arguments use atom keys (e.g., :primary_key) while caller-supplied :args use string keys after JSON round-tripping. Map.merge does not detect collisions between atom and string keys, so both survive in memory. When the job is persisted to storage, JSON de-duplication retains only the last (string) key, allowing the caller's value to override the trusted action parameters. An attacker providing malicious input to the :args option can retarget trigger actions to arbitrary records or across tenants. No authentication is required—any user input reaching the :args parameter is at risk. The vulnerability affects ash_oban versions 0.2.5 through 0.8.13; patched in 0.8.14 and later.
Affected products
- ash-project ash_oban 0.2.5 to 0.8.13
Timeline
- 2026-08-30: disclosed: CVE-2026-78038 published
- 2026-08-30: patched: Fix available in version 0.8.14 and later