CVE-2026-101028

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-101028", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "state": "PUBLISHED", "assignerShortName": "EEF", "dateReserved": "2026-10-08T15:45:02.376Z", "datePublished": "2026-10-09T07:01:06.470Z", "dateUpdated": "2026-10-09T18:04:24.729Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://repo.hex.pm", "cpes": ["cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Ash.Actions.Aggregate'", "'Elixir.Ash'"], "packageName": "ash", "packageURL": "pkg:hex/ash", "product": "ash", "programFiles": ["lib/ash/actions/aggregate.ex", "lib/ash.ex"], "programRoutines": [{"name": "'Elixir.Ash.Actions.Aggregate':run/4"}, {"name": "'Elixir.Ash':count/2"}, {"name": "'Elixir.Ash':exists/2"}, {"name": "'Elixir.Ash':aggregate/3"}], "repo": "https://github.com/ash-project/ash", "vendor": "ash-project", "versions": [{"lessThan": "3.34.6", "status": "affected", "version": "2.6.0", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Ash.Actions.Aggregate'", "'Elixir.Ash'"], "packageName": "ash-project/ash", "packageURL": "pkg:github/ash-project/ash", "product": "ash", "programFiles": ["lib/ash/actions/aggregate.ex", "lib/ash.ex"], "programRoutines": [{"name": "'Elixir.Ash.Actions.Aggregate':run/4"}, {"name": "'Elixir.Ash':count/2"}, {"name": "'Elixir.Ash':exists/2"}, {"name": "'Elixir.Ash':aggregate/3"}], "repo": "https://github.com/ash-project/ash", "vendor": "ash-project", "versions": [{"lessThan": "80936187b27ee94f15cd875affd3141b5cb23185", "status": "affected", "version": "30eaf1c6e8524527b703e3c4bfeff7967ee0b37c", "versionType": "git"}]}], "configurations": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Reachable only when an application passes caller-supplied filters or sorts that cross a relationship into <code>Ash.count/2</code>, <code>Ash.exists/2</code> or <code>Ash.aggregate/3</code> (directly, through ash_lua read operations, or through AshAi count, exists or aggregate result types), and a related resource's read policy is stricter than the root resource's.</p>"}, {"base64": false, "type": "text/markdown", "value": "Reachable only when an application passes caller-supplied filters or sorts that cross a relationship into `Ash.count/2`, `Ash.exists/2` or `Ash.aggregate/3` (directly, through ash_lua read operations, or through AshAi count, exists or aggregate result types), and a related resource's read policy is stricter than the root resource's."}], "value": "Reachable only when an application passes caller-supplied filters or sorts that cross a relationship into Ash.count/2, Ash.exists/2 or Ash.aggregate/3 (directly, through ash_lua read operations, or through AshAi count, exists or aggregate result types), and a related resource's read policy is stricter than the root resource's."}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*", "versionEndExcluding": "3.34.6", "versionStartIncluding": "2.6.0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "credits": [{"lang": "en", "type": "reporter", "value": "Glenn Rempe"}, {"lang": "en", "type": "finder", "value": "Glenn Rempe"}, {"lang": "en", "type": "remediation developer", "value": "Zach Daniel / Ash Project"}], "dateAssigned": "2026-10-09T00:19:31.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Incorrect Authorization vulnerability in ash-project ash allows an actor to infer data in related records they cannot read via <code>Ash.count/2</code>, <code>Ash.exists/2</code> and <code>Ash.aggregate/3</code>.</p>\n<p><code>Ash.Actions.Aggregate.run/4</code> (<code>lib/ash/actions/aggregate.ex</code>) applied only the root resource's read policy before running the aggregate query. The read path also applies each related resource's read policy to filter and sort references that cross a relationship, directly (for example <code>comments.body</code>) or through an aggregate over one, but the aggregate path skipped that step. A caller whose filter or sort reaches these functions, for example through <code>Ash.Query.filter_input/2</code>, an ash_lua script, or an AshAi tool offering count or exists results, can test conditions against related rows hidden from them and recover their existence and attribute values one query at a time. <code>Ash.read/2</code> and its page counts are not affected.</p>\n<p>This issue affects ash: from 2.6.0 before 3.34.6.</p>"}, {"base64": false, "type": "text/markdown", "value": "Incorrect Authorization vulnerability in ash-project ash allows an actor to infer data in related records they cannot read via `Ash.count/2`, `Ash.exists/2` and `Ash.aggregate/3`.\n\n`Ash.Actions.Aggregate.run/4` (`lib/ash/actions/aggregate.ex`) applied only the root resource's read policy before running the aggregate query. The read path also applies each related resource's read policy to filter and sort references that cross a relationship, directly (for example `comments.body`) or through an aggregate over one, but the aggregate path skipped that step. A caller whose filter or sort reaches these functions, for example through `Ash.Query.filter_input/2`, an ash_lua script, or an AshAi tool offering count or exists results, can test conditions against related rows hidden from them and recover their existence and attribute values one query at a time. `Ash.read/2` and its page counts are not affected.\n\nThis issue affects ash: from 2.6.0 before 3.34.6."}], "value": "Incorrect Authorization vulnerability in ash-project ash allows an actor to infer data in related records they cannot read via Ash.count/2, Ash.exists/2 and Ash.aggregate/3.\n\nAsh.Actions.Aggregate.run/4 (lib/ash/actions/aggregate.ex) applied only the root resource's read policy before running the aggregate query. The read path also applies each related resource's read policy to filter and sort references that cross a relationship, directly (for example comments.body) or through an aggregate over one, but the aggregate path skipped that step. A caller whose filter or sort reaches these functions, for example through Ash.Query.filter_input/2, an ash_lua script, or an AshAi tool offering count or exists results, can test conditions against related rows hidden from them and recover their existence and attribute values one query at a time. Ash.read/2 and its page counts are not affected.\n\nThis issue affects ash: from 2.6.0 before 3.34.6."}], "impacts": [{"capecId": "CAPEC-1", "descriptions": [{"lang": "en", "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 6, "baseSeverity": "MEDIUM", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-10-09T07:01:06.470Z"}, "references": [{"name": "GHSA-xj24-8f5c-pp5p", "tags": ["vendor-advisory", "related"], "url": "https://github.com/ash-project/ash/security/advisories/GHSA-xj24-8f5c-pp5p"}, {"name": "EEF CNA record for CVE-2026-101028", "tags": ["related"], "url": "https://cna.erlef.org/cves/CVE-2026-101028.html"}, {"name": "OSV record EEF-CVE-2026-101028", "tags": ["related"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-101028"}, {"name": "Introducing commit 30eaf1c in ash-project/ash", "tags": ["related"], "url": "https://github.com/ash-project/ash/commit/30eaf1c6e8524527b703e3c4bfeff7967ee0b37c"}, {"name": "Fix commit 8093618 in ash-project/ash", "tags": ["patch"], "url": "https://github.com/ash-project/ash/commit/80936187b27ee94f15cd875affd3141b5cb23185"}], "source": {"discovery": "EXTERNAL"}, "title": "Ash.count, Ash.exists and Ash.aggregate skip related resources' read policies in filters and sorts"}, "adp": [{"references": [{"url": "https://github.com/ash-project/ash/security/advisories/GHSA-xj24-8f5c-pp5p", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-09T18:03:54.666261Z", "id": "CVE-2026-101028", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-09T18:04:24.729Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-101028", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-09T18:03:54.666261Z"}}}], "references": [{"url": "https://github.com/ash-project/ash/security/advisories/GHSA-xj24-8f5c-pp5p", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-09T18:04:20.877Z"}}], "cna": {"title": "Ash.count, Ash.exists and Ash.aggregate skip related resources' read policies in filters and sorts", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "reporter", "value": "Glenn Rempe"}, {"lang": "en", "type": "finder", "value": "Glenn Rempe"}, {"lang": "en", "type": "remediation developer", "value": "Zach Daniel / Ash Project"}], "impacts": [{"capecId": "CAPEC-1", "descriptions": [{"lang": "en", "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"], "repo": "https://github.com/ash-project/ash", "vendor": "ash-project", "modules": ["'Elixir.Ash.Actions.Aggregate'", "'Elixir.Ash'"], "product": "ash", "versions": [{"status": "affected", "version": "2.6.0", "lessThan": "3.34.6", "versionType": "semver"}], "packageURL": "pkg:hex/ash", "packageName": "ash", "programFiles": ["lib/ash/actions/aggregate.ex", "lib/ash.ex"], "collectionURL": "https://repo.hex.pm", "defaultStatus": "unaffected", "programRoutines": [{"name": "'Elixir.Ash.Actions.Aggregate':run/4"}, {"name": "'Elixir.Ash':count/2"}, {"name": "'Elixir.Ash':exists/2"}, {"name": "'Elixir.Ash':aggregate/3"}]}, {"cpes": ["cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"], "repo": "https://github.com/ash-project/ash", "vendor": "ash-project", "modules": ["'Elixir.Ash.Actions.Aggregate'", "'Elixir.Ash'"], "product": "ash", "versions": [{"status": "affected", "version": "30eaf1c6e8524527b703e3c4bfeff7967ee0b37c", "lessThan": "80936187b27ee94f15cd875affd3141b5cb23185", "versionType": "git"}], "packageURL": "pkg:github/ash-project/ash", "packageName": "ash-project/ash", "programFiles": ["lib/ash/actions/aggregate.ex", "lib/ash.ex"], "collectionURL": "https://github.com", "defaultStatus": "unaffected", "programRoutines": [{"name": "'Elixir.Ash.Actions.Aggregate':run/4"}, {"name": "'Elixir.Ash':count/2"}, {"name": "'Elixir.Ash':exists/2"}, {"name": "'Elixir.Ash':aggregate/3"}]}], "references": [{"url": "https://github.com/ash-project/ash/security/advisories/GHSA-xj24-8f5c-pp5p", "name": "GHSA-xj24-8f5c-pp5p", "tags": ["vendor-advisory", "related"]}, {"url": "https://cna.erlef.org/cves/CVE-2026-101028.html", "name": "EEF CNA record for CVE-2026-101028", "tags": ["related"]}, {"url": "https://osv.dev/vulnerability/EEF-CVE-2026-101028", "name": "OSV record EEF-CVE-2026-101028", "tags": ["related"]}, {"url": "https://github.com/ash-project/ash/commit/30eaf1c6e8524527b703e3c4bfeff7967ee0b37c", "name": "Introducing commit 30eaf1c in ash-project/ash", "tags": ["related"]}, {"url": "https://github.com/ash-project/ash/commit/80936187b27ee94f15cd875affd3141b5cb23185", "name": "Fix commit 8093618 in ash-project/ash", "tags": ["patch"]}], "dateAssigned": "2026-10-09T00:19:31.000Z", "descriptions": [{"lang": "en", "value": "Incorrect Authorization vulnerability in ash-project ash allows an actor to infer data in related records they cannot read via Ash.count/2, Ash.exists/2 and Ash.aggregate/3.\n\nAsh.Actions.Aggregate.run/4 (lib/ash/actions/aggregate.ex) applied only the root resource's read policy before running the aggregate query. The read path also applies each related resource's read policy to filter and sort references that cross a relationship, directly (for example comments.body) or through an aggregate over one, but the aggregate path skipped that step. A caller whose filter or sort reaches these functions, for example through Ash.Query.filter_input/2, an ash_lua script, or an AshAi tool offering count or exists results, can test conditions against related rows hidden from them and recover their existence and attribute values one query at a time. Ash.read/2 and its page counts are not affected.\n\nThis issue affects ash: from 2.6.0 before 3.34.6.", "supportingMedia": [{"type": "text/html", "value": "<p>Incorrect Authorization vulnerability in ash-project ash allows an actor to infer data in related records they cannot read via <code>Ash.count/2</code>, <code>Ash.exists/2</code> and <code>Ash.aggregate/3</code>.</p>\n<p><code>Ash.Actions.Aggregate.run/4</code> (<code>lib/ash/actions/aggregate.ex</code>) applied only the root resource's read policy before running the aggregate query. The read path also applies each related resource's read policy to filter and sort references that cross a relationship, directly (for example <code>comments.body</code>) or through an aggregate over one, but the aggregate path skipped that step. A caller whose filter or sort reaches these functions, for example through <code>Ash.Query.filter_input/2</code>, an ash_lua script, or an AshAi tool offering count or exists results, can test conditions against related rows hidden from them and recover their existence and attribute values one query at a time. <code>Ash.read/2</code> and its page counts are not affected.</p>\n<p>This issue affects ash: from 2.6.0 before 3.34.6.</p>", "base64": false}, {"type": "text/markdown", "value": "Incorrect Authorization vulnerability in ash-project ash allows an actor to infer data in related records they cannot read via `Ash.count/2`, `Ash.exists/2` and `Ash.aggregate/3`.\n\n`Ash.Actions.Aggregate.run/4` (`lib/ash/actions/aggregate.ex`) applied only the root resource's read policy before running the aggregate query. The read path also applies each related resource's read policy to filter and sort references that cross a relationship, directly (for example `comments.body`) or through an aggregate over one, but the aggregate path skipped that step. A caller whose filter or sort reaches these functions, for example through `Ash.Query.filter_input/2`, an ash_lua script, or an AshAi tool offering count or exists results, can test conditions against related rows hidden from them and recover their existence and attribute values one query at a time. `Ash.read/2` and its page counts are not affected.\n\nThis issue affects ash: from 2.6.0 before 3.34.6.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization"}]}], "configurations": [{"lang": "en", "value": "Reachable only when an application passes caller-supplied filters or sorts that cross a relationship into Ash.count/2, Ash.exists/2 or Ash.aggregate/3 (directly, through ash_lua read operations, or through AshAi count, exists or aggregate result types), and a related resource's read policy is stricter than the root resource's.", "supportingMedia": [{"type": "text/html", "value": "<p>Reachable only when an application passes caller-supplied filters or sorts that cross a relationship into <code>Ash.count/2</code>, <code>Ash.exists/2</code> or <code>Ash.aggregate/3</code> (directly, through ash_lua read operations, or through AshAi count, exists or aggregate result types), and a related resource's read policy is stricter than the root resource's.</p>", "base64": false}, {"type": "text/markdown", "value": "Reachable only when an application passes caller-supplied filters or sorts that cross a relationship into `Ash.count/2`, `Ash.exists/2` or `Ash.aggregate/3` (directly, through ash_lua read operations, or through AshAi count, exists or aggregate result types), and a related resource's read policy is stricter than the root resource's.", "base64": false}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "3.34.6", "versionStartIncluding": "2.6.0"}], "operator": "OR"}], "operator": "AND"}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-10-09T07:01:06.470Z"}}}, "cveMetadata": {"cveId": "CVE-2026-101028", "state": "PUBLISHED", "dateUpdated": "2026-10-09T18:04:24.729Z", "dateReserved": "2026-10-08T15:45:02.376Z", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "datePublished": "2026-10-09T07:01:06.470Z", "assignerShortName": "EEF"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.hex.pm", "cpes": ["cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Ash.Actions.Aggregate'", "'Elixir.Ash'"], "packageName": "ash", "packageURL": "pkg:hex/ash", "product": "ash", "programFiles": ["lib/ash/actions/aggregate.ex", "lib/ash.ex"], "programRoutines": [{"name": "'Elixir.Ash.Actions.Aggregate':run/4"}, {"name": "'Elixir.Ash':count/2"}, {"name": "'Elixir.Ash':exists/2"}, {"name": "'Elixir.Ash':aggregate/3"}], "repo": "https://github.com/ash-project/ash", "vendor": "ash-project", "versions": [{"lessThan": "3.34.6", "status": "affected", "version": "2.6.0", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Ash.Actions.Aggregate'", "'Elixir.Ash'"], "packageName": "ash-project/ash", "packageURL": "pkg:github/ash-project/ash", "product": "ash", "programFiles": ["lib/ash/actions/aggregate.ex", "lib/ash.ex"], "programRoutines": [{"name": "'Elixir.Ash.Actions.Aggregate':run/4"}, {"name": "'Elixir.Ash':count/2"}, {"name": "'Elixir.Ash':exists/2"}, {"name": "'Elixir.Ash':aggregate/3"}], "repo": "https://github.com/ash-project/ash", "vendor": "ash-project", "versions": [{"lessThan": "80936187b27ee94f15cd875affd3141b5cb23185", "status": "affected", "version": "30eaf1c6e8524527b703e3c4bfeff7967ee0b37c", "versionType": "git"}]}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Incorrect Authorization vulnerability in ash-project ash allows an actor to infer data in related records they cannot read via Ash.count/2, Ash.exists/2 and Ash.aggregate/3.\n\nAsh.Actions.Aggregate.run/4 (lib/ash/actions/aggregate.ex) applied only the root resource's read policy before running the aggregate query. The read path also applies each related resource's read policy to filter and sort references that cross a relationship, directly (for example comments.body) or through an aggregate over one, but the aggregate path skipped that step. A caller whose filter or sort reaches these functions, for example through Ash.Query.filter_input/2, an ash_lua script, or an AshAi tool offering count or exists results, can test conditions against related rows hidden from them and recover their existence and attribute values one query at a time. Ash.read/2 and its page counts are not affected.\n\nThis issue affects ash: from 2.6.0 before 3.34.6."}], "id": "CVE-2026-101028", "lastModified": "2026-10-09T18:17:01.197", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.0, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-101028", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-09T18:03:54.666261Z", "version": "2.0.3"}}]}, "published": "2026-10-09T07:17:17.627", "references": [{"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://cna.erlef.org/cves/CVE-2026-101028.html"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/ash-project/ash/commit/30eaf1c6e8524527b703e3c4bfeff7967ee0b37c"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/ash-project/ash/commit/80936187b27ee94f15cd875affd3141b5cb23185"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/ash-project/ash/security/advisories/GHSA-xj24-8f5c-pp5p"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://osv.dev/vulnerability/EEF-CVE-2026-101028"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/ash-project/ash/security/advisories/GHSA-xj24-8f5c-pp5p"}], "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}]}

{"bugzilla": {"description": "ash: Ash: Information disclosure via missing authorization checks in aggregate queries", "id": "2548379", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2548379"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-1230", "details": ["Incorrect Authorization vulnerability in ash-project ash allows an actor to infer data in related records they cannot read via Ash.count/2, Ash.exists/2 and Ash.aggregate/3.\nAsh.Actions.Aggregate.run/4 (lib/ash/actions/aggregate.ex) applied only the root resource's read policy before running the aggregate query. The read path also applies each related resource's read policy to filter and sort references that cross a relationship, directly (for example comments.body) or through an aggregate over one, but the aggregate path skipped that step. A caller whose filter or sort reaches these functions, for example through Ash.Query.filter_input/2, an ash_lua script, or an AshAi tool offering count or exists results, can test conditions against related rows hidden from them and recover their existence and attribute values one query at a time. Ash.read/2 and its page counts are not affected.\nThis issue affects ash: from 2.6.0 before 3.34.6.", "A flaw was found in the Ash framework. An authorized user can infer sensitive information from restricted related records by submitting queries that use aggregate functions, such as counting or checking for record existence. Because read authorization policies on related resources are not enforced during aggregate operations, an attacker can incrementally test conditions to deduce unauthorized data."], "name": "CVE-2026-101028", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-10-09T07:01:06Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-101028\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-101028\nhttps://cna.erlef.org/cves/CVE-2026-101028.html\nhttps://github.com/ash-project/ash/commit/30eaf1c6e8524527b703e3c4bfeff7967ee0b37c\nhttps://github.com/ash-project/ash/commit/80936187b27ee94f15cd875affd3141b5cb23185\nhttps://github.com/ash-project/ash/security/advisories/GHSA-xj24-8f5c-pp5p\nhttps://osv.dev/vulnerability/EEF-CVE-2026-101028"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.6.0,3.34.6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[30eaf1c6e8524527b703e3c4bfeff7967ee0b37c,80936187b27ee94f15cd875affd3141b5cb23185)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "ash", "vendor": "ash-project"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.6.0,3.34.6)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "ash", "source": "cna", "vendor": "ash-project"}, "product": "ash", "vendor": "ash-project"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[30eaf1c6e8524527b703e3c4bfeff7967ee0b37c,80936187b27ee94f15cd875affd3141b5cb23185)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "ash", "source": "cna", "vendor": "ash-project"}, "product": "ash", "vendor": "ash-project"}], "created": "2026-10-09T08:29:25.991706+00:00", "updated": "2026-10-13T02:15:15.132330+00:00", "vendors": ["ash-project", "ash-project$PRODUCT$ash"]}