Quick answers
- Is CVE-2026-78693 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-78693 being exploited in the wild.
- How severe is CVE-2026-78693?
- Informational severity, published 30 August 2026.
- Which products and versions are affected?
- Ash-Project Ash Graphql from 1.9.0 before 1.11.0.
- Is there a fix for CVE-2026-78693?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-78693 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-78693?
- Check whether you run Ash-Project Ash Graphql at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability exists in AshGraphql.Errors where error handling logic uses Map.put_new to merge the error_handler's sanitized response with an error path. Because put_new only uses the handler's :path value if already set, a sanitizing handler that deletes :path to redact information is circumvented—the deleted path is replaced with build_error_path/5's output. That function falls back to raw internal Ash attribute and argument names when no field_names mapping is configured, causing validation failures on non-exposed or nested fields to leak internal names in the GraphQL error response. The attack requires only network access to the GraphQL endpoint and does not require authentication. An attacker can discover unexposed schema fields and internal naming conventions by triggering validation errors.
Affected products
- ash-project ash_graphql from 1.9.0 before 1.11.0
Timeline
- 2026-08-30: disclosed