CVE-2026-81633
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Unhandled KeyError in AshGraphql relay node resolution crashes queries via an unknown type segment
Improper Input Validation vulnerability in ash-project ash_graphql allows an unauthenticated client to crash a relay node(id: ...) query with an unhandled KeyError. AshGraphql.Graphql.Resolver.resolve_node/2 decodes the client-supplied global ID with decode_relay_id/1, which only base64-decodes the string and splits it on : without validating the type segment. The decoded type is passed straight to Map.fetch!(type_to_domain_and_resource_map, type). Because fetch! raises on a missing key, a relay ID whose type segment is a valid atom that is not a relay-exposed type aborts the resolver before its resolve/2 clauses and their rescue handlers run, so the error never becomes a GraphQL error and may expose a stacktrace. Common resource names are easy to guess. The fix uses Map.fetch/2 and returns an Invalid node id error for unknown types. This issue affects ash_graphql: from 0.27.0 before 1.11.0.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
ash_graphql
- Vendor
- ash-project
- Product
- ash_graphql
- Platforms
- Unknown
- Default status
unaffected- Package
- ash_graphql
- Package collection
- https://repo.hex.pm
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 0.27.0 | affected | semver | 1.11.0 | Unavailable | None listed |
ash_graphql
- Vendor
- ash-project
- Product
- ash_graphql
- Platforms
- Unknown
- Default status
unaffected- Package
- ash-project/ash_graphql
- Package collection
- https://github.com
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 365b3aedc6b36f020e6a2c7dce63fa569243bc4e | affected | git | c8863ed8e5c21f1bfb6125f1d24e78443dfc6351 | Unavailable | None listed |