CVE-2026-70395

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-70395", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "state": "PUBLISHED", "assignerShortName": "EEF", "dateReserved": "2026-08-04T14:30:01.369Z", "datePublished": "2026-08-09T18:17:07.321Z", "dateUpdated": "2026-08-10T18:23:15.009Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://repo.hex.pm", "cpes": ["cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Ash.Actions.ManagedRelationships'", "'Elixir.Ash.Changeset'"], "packageName": "ash", "packageURL": "pkg:hex/ash", "product": "ash", "programFiles": ["lib/ash/actions/managed_relationships.ex", "lib/ash/changeset/changeset.ex"], "programRoutines": [{"name": "'Elixir.Ash.Actions.ManagedRelationships':setup_managed_belongs_to_relationships/3"}, {"name": "'Elixir.Ash.Changeset':manage_relationship/4"}], "repo": "https://github.com/ash-project/ash", "vendor": "ash-project", "versions": [{"lessThan": "3.31.1", "status": "affected", "version": "1.52.0-rc.11", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Ash.Actions.ManagedRelationships'", "'Elixir.Ash.Changeset'"], "packageName": "ash-project/ash", "packageURL": "pkg:github/ash-project/ash", "product": "ash", "programFiles": ["lib/ash/actions/managed_relationships.ex", "lib/ash/changeset/changeset.ex"], "programRoutines": [{"name": "'Elixir.Ash.Actions.ManagedRelationships':setup_managed_belongs_to_relationships/3"}, {"name": "'Elixir.Ash.Changeset':manage_relationship/4"}], "repo": "https://github.com/ash-project/ash", "vendor": "ash-project", "versions": [{"lessThan": "09f42593035bceb0f6153dd7ee45cc49d108300a", "status": "affected", "version": "571c138140e71cea24005189f45d7a63c8d2ed20", "versionType": "git"}]}], "configurations": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>A <code>belongs_to</code> relationship must be managed with <code>manage_relationship</code> using <code>on_lookup: :relate</code>, and the lookup value must come from client input.</p>"}, {"base64": false, "type": "text/markdown", "value": "A `belongs_to` relationship must be managed with `manage_relationship` using `on_lookup: :relate`, and the lookup value must come from client input."}], "value": "A belongs_to relationship must be managed with manage_relationship using on_lookup: :relate, and the lookup value must come from client input."}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*", "versionEndExcluding": "3.31.1", "versionStartIncluding": "1.52.0-rc.11", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "credits": [{"lang": "en", "type": "finder", "value": "Jisung Chae"}, {"lang": "en", "type": "remediation developer", "value": "Zach Daniel"}, {"lang": "en", "type": "analyst", "value": "Jonatan M\u00e4nnchen / EEF"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash allows an attacker to forge a relationship to a record they cannot name, and to recover the secret value used to look it up.</p>\n<p>When <code>manage_relationship</code> is used with <code>on_lookup: :relate</code> on a <code>belongs_to</code> relationship, the client-supplied lookup value is passed to <code>Ash.Query.filter/2</code> without being cast to the attribute type. A nested map submitted where a scalar is expected is therefore interpreted as a filter predicate rather than a literal, so a lookup for a specific record becomes a query for any record matching a condition. The same path omits <code>Ash.Query.limit(1)</code>, leaving <code>Ash.read_one/2</code> able to distinguish no match from one match from several, which turns comparison predicates into an oracle for the lookup value. Authorization is unaffected; the destination read policy still applies.</p>\n<p>This issue affects ash: from 1.52.0-rc.11 before 3.31.1.</p>"}, {"base64": false, "type": "text/markdown", "value": "Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash allows an attacker to forge a relationship to a record they cannot name, and to recover the secret value used to look it up.\n\nWhen `manage_relationship` is used with `on_lookup: :relate` on a `belongs_to` relationship, the client-supplied lookup value is passed to `Ash.Query.filter/2` without being cast to the attribute type. A nested map submitted where a scalar is expected is therefore interpreted as a filter predicate rather than a literal, so a lookup for a specific record becomes a query for any record matching a condition. The same path omits `Ash.Query.limit(1)`, leaving `Ash.read_one/2` able to distinguish no match from one match from several, which turns comparison predicates into an oracle for the lookup value. Authorization is unaffected; the destination read policy still applies.\n\nThis issue affects ash: from 1.52.0-rc.11 before 3.31.1."}], "value": "Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash allows an attacker to forge a relationship to a record they cannot name, and to recover the secret value used to look it up.\n\nWhen manage_relationship is used with on_lookup: :relate on a belongs_to relationship, the client-supplied lookup value is passed to Ash.Query.filter/2 without being cast to the attribute type. A nested map submitted where a scalar is expected is therefore interpreted as a filter predicate rather than a literal, so a lookup for a specific record becomes a query for any record matching a condition. The same path omits Ash.Query.limit(1), leaving Ash.read_one/2 able to distinguish no match from one match from several, which turns comparison predicates into an oracle for the lookup value. Authorization is unaffected; the destination read policy still applies.\n\nThis issue affects ash: from 1.52.0-rc.11 before 3.31.1."}], "impacts": [{"capecId": "CAPEC-116", "descriptions": [{"lang": "en", "value": "CAPEC-116 Excavation"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "baseScore": 2.1, "baseSeverity": "LOW", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-943", "description": "CWE-943 Improper Neutralization of Special Elements in Data Query Logic", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-08-09T18:17:07.321Z"}, "references": [{"tags": ["related", "vendor-advisory"], "url": "https://github.com/ash-project/ash/security/advisories/GHSA-vvp6-3wv6-833j"}, {"tags": ["related"], "url": "https://cna.erlef.org/cves/CVE-2026-70395.html"}, {"tags": ["related"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-70395"}, {"tags": ["patch"], "url": "https://github.com/ash-project/ash/commit/09f42593035bceb0f6153dd7ee45cc49d108300a"}], "source": {"discovery": "EXTERNAL"}, "title": "Predicate injection in manage_relationship belongs_to lookup discloses secret lookup keys in Ash"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-10T15:56:57.175785Z", "id": "CVE-2026-70395", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-10T18:23:15.009Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "Predicate injection in manage_relationship belongs_to lookup discloses secret lookup keys in Ash", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Jisung Chae"}, {"lang": "en", "type": "remediation developer", "value": "Zach Daniel"}, {"lang": "en", "type": "analyst", "value": "Jonatan M\u00e4nnchen / EEF"}], "impacts": [{"capecId": "CAPEC-116", "descriptions": [{"lang": "en", "value": "CAPEC-116 Excavation"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.1, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"], "repo": "https://github.com/ash-project/ash", "vendor": "ash-project", "modules": ["'Elixir.Ash.Actions.ManagedRelationships'", "'Elixir.Ash.Changeset'"], "product": "ash", "versions": [{"status": "affected", "version": "1.52.0-rc.11", "lessThan": "3.31.1", "versionType": "semver"}], "packageURL": "pkg:hex/ash", "packageName": "ash", "programFiles": ["lib/ash/actions/managed_relationships.ex", "lib/ash/changeset/changeset.ex"], "collectionURL": "https://repo.hex.pm", "defaultStatus": "unaffected", "programRoutines": [{"name": "'Elixir.Ash.Actions.ManagedRelationships':setup_managed_belongs_to_relationships/3"}, {"name": "'Elixir.Ash.Changeset':manage_relationship/4"}]}, {"cpes": ["cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"], "repo": "https://github.com/ash-project/ash", "vendor": "ash-project", "modules": ["'Elixir.Ash.Actions.ManagedRelationships'", "'Elixir.Ash.Changeset'"], "product": "ash", "versions": [{"status": "affected", "version": "571c138140e71cea24005189f45d7a63c8d2ed20", "lessThan": "09f42593035bceb0f6153dd7ee45cc49d108300a", "versionType": "git"}], "packageURL": "pkg:github/ash-project/ash", "packageName": "ash-project/ash", "programFiles": ["lib/ash/actions/managed_relationships.ex", "lib/ash/changeset/changeset.ex"], "collectionURL": "https://github.com", "defaultStatus": "unaffected", "programRoutines": [{"name": "'Elixir.Ash.Actions.ManagedRelationships':setup_managed_belongs_to_relationships/3"}, {"name": "'Elixir.Ash.Changeset':manage_relationship/4"}]}], "references": [{"url": "https://github.com/ash-project/ash/security/advisories/GHSA-vvp6-3wv6-833j", "tags": ["related", "vendor-advisory"]}, {"url": "https://cna.erlef.org/cves/CVE-2026-70395.html", "tags": ["related"]}, {"url": "https://osv.dev/vulnerability/EEF-CVE-2026-70395", "tags": ["related"]}, {"url": "https://github.com/ash-project/ash/commit/09f42593035bceb0f6153dd7ee45cc49d108300a", "tags": ["patch"]}], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash allows an attacker to forge a relationship to a record they cannot name, and to recover the secret value used to look it up.\n\nWhen manage_relationship is used with on_lookup: :relate on a belongs_to relationship, the client-supplied lookup value is passed to Ash.Query.filter/2 without being cast to the attribute type. A nested map submitted where a scalar is expected is therefore interpreted as a filter predicate rather than a literal, so a lookup for a specific record becomes a query for any record matching a condition. The same path omits Ash.Query.limit(1), leaving Ash.read_one/2 able to distinguish no match from one match from several, which turns comparison predicates into an oracle for the lookup value. Authorization is unaffected; the destination read policy still applies.\n\nThis issue affects ash: from 1.52.0-rc.11 before 3.31.1.", "supportingMedia": [{"type": "text/html", "value": "<p>Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash allows an attacker to forge a relationship to a record they cannot name, and to recover the secret value used to look it up.</p>\n<p>When <code>manage_relationship</code> is used with <code>on_lookup: :relate</code> on a <code>belongs_to</code> relationship, the client-supplied lookup value is passed to <code>Ash.Query.filter/2</code> without being cast to the attribute type. A nested map submitted where a scalar is expected is therefore interpreted as a filter predicate rather than a literal, so a lookup for a specific record becomes a query for any record matching a condition. The same path omits <code>Ash.Query.limit(1)</code>, leaving <code>Ash.read_one/2</code> able to distinguish no match from one match from several, which turns comparison predicates into an oracle for the lookup value. Authorization is unaffected; the destination read policy still applies.</p>\n<p>This issue affects ash: from 1.52.0-rc.11 before 3.31.1.</p>", "base64": false}, {"type": "text/markdown", "value": "Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash allows an attacker to forge a relationship to a record they cannot name, and to recover the secret value used to look it up.\n\nWhen `manage_relationship` is used with `on_lookup: :relate` on a `belongs_to` relationship, the client-supplied lookup value is passed to `Ash.Query.filter/2` without being cast to the attribute type. A nested map submitted where a scalar is expected is therefore interpreted as a filter predicate rather than a literal, so a lookup for a specific record becomes a query for any record matching a condition. The same path omits `Ash.Query.limit(1)`, leaving `Ash.read_one/2` able to distinguish no match from one match from several, which turns comparison predicates into an oracle for the lookup value. Authorization is unaffected; the destination read policy still applies.\n\nThis issue affects ash: from 1.52.0-rc.11 before 3.31.1.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-943", "description": "CWE-943 Improper Neutralization of Special Elements in Data Query Logic"}]}], "configurations": [{"lang": "en", "value": "A belongs_to relationship must be managed with manage_relationship using on_lookup: :relate, and the lookup value must come from client input.", "supportingMedia": [{"type": "text/html", "value": "<p>A <code>belongs_to</code> relationship must be managed with <code>manage_relationship</code> using <code>on_lookup: :relate</code>, and the lookup value must come from client input.</p>", "base64": false}, {"type": "text/markdown", "value": "A `belongs_to` relationship must be managed with `manage_relationship` using `on_lookup: :relate`, and the lookup value must come from client input.", "base64": false}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "3.31.1", "versionStartIncluding": "1.52.0-rc.11"}], "operator": "OR"}], "operator": "AND"}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-08-09T18:17:07.321Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-70395", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-10T15:56:57.175785Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-08-10T15:57:01.472Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-70395", "state": "PUBLISHED", "dateUpdated": "2026-08-09T18:17:07.321Z", "dateReserved": "2026-08-04T14:30:01.369Z", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "datePublished": "2026-08-09T18:17:07.321Z", "assignerShortName": "EEF"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.hex.pm", "cpes": ["cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Ash.Actions.ManagedRelationships'", "'Elixir.Ash.Changeset'"], "packageName": "ash", "packageURL": "pkg:hex/ash", "product": "ash", "programFiles": ["lib/ash/actions/managed_relationships.ex", "lib/ash/changeset/changeset.ex"], "programRoutines": [{"name": "'Elixir.Ash.Actions.ManagedRelationships':setup_managed_belongs_to_relationships/3"}, {"name": "'Elixir.Ash.Changeset':manage_relationship/4"}], "repo": "https://github.com/ash-project/ash", "vendor": "ash-project", "versions": [{"lessThan": "3.31.1", "status": "affected", "version": "1.52.0-rc.11", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Ash.Actions.ManagedRelationships'", "'Elixir.Ash.Changeset'"], "packageName": "ash-project/ash", "packageURL": "pkg:github/ash-project/ash", "product": "ash", "programFiles": ["lib/ash/actions/managed_relationships.ex", "lib/ash/changeset/changeset.ex"], "programRoutines": [{"name": "'Elixir.Ash.Actions.ManagedRelationships':setup_managed_belongs_to_relationships/3"}, {"name": "'Elixir.Ash.Changeset':manage_relationship/4"}], "repo": "https://github.com/ash-project/ash", "vendor": "ash-project", "versions": [{"lessThan": "09f42593035bceb0f6153dd7ee45cc49d108300a", "status": "affected", "version": "571c138140e71cea24005189f45d7a63c8d2ed20", "versionType": "git"}]}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash allows an attacker to forge a relationship to a record they cannot name, and to recover the secret value used to look it up.\n\nWhen manage_relationship is used with on_lookup: :relate on a belongs_to relationship, the client-supplied lookup value is passed to Ash.Query.filter/2 without being cast to the attribute type. A nested map submitted where a scalar is expected is therefore interpreted as a filter predicate rather than a literal, so a lookup for a specific record becomes a query for any record matching a condition. The same path omits Ash.Query.limit(1), leaving Ash.read_one/2 able to distinguish no match from one match from several, which turns comparison predicates into an oracle for the lookup value. Authorization is unaffected; the destination read policy still applies.\n\nThis issue affects ash: from 1.52.0-rc.11 before 3.31.1."}, {"lang": "es", "value": "vulnerabilidad de neutralizaci\u00f3n incorrecta de elementos especiales en la l\u00f3gica de consulta de datos en ash-project ash permite a un atacante forjar una relaci\u00f3n con un registro que no pueden nombrar, y recuperar el valor secreto utilizado para buscarlo.\n\nCuando manage_relationship se utiliza con on_lookup: :relate en una relaci\u00f3n belongs_to, el valor de b\u00fasqueda proporcionado por el cliente se pasa a Ash.Query.filter/2 sin ser convertido al tipo de atributo. Un mapa anidado enviado donde se espera un escalar se interpreta, por lo tanto, como un predicado de filtro en lugar de un literal, por lo que una b\u00fasqueda de un registro espec\u00edfico se convierte en una consulta para cualquier registro que coincida con una condici\u00f3n. La misma ruta omite Ash.Query.limit(1), dejando a Ash.read_one/2 capaz de distinguir ninguna coincidencia de una coincidencia de varias, lo que convierte los predicados de comparaci\u00f3n en un or\u00e1culo para el valor de b\u00fasqueda. La autorizaci\u00f3n no se ve afectada; la pol\u00edtica de lectura de destino sigue aplic\u00e1ndose.\n\nEste problema afecta a ash: desde 1.52.0-rc.11 antes de 3.31.1."}], "id": "CVE-2026-70395", "lastModified": "2026-10-24T16:10:00.153", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-70395", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-10T15:56:57.175785Z", "version": "2.0.3"}}]}, "published": "2026-08-09T19:17:02.547", "references": [{"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://cna.erlef.org/cves/CVE-2026-70395.html"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/ash-project/ash/commit/09f42593035bceb0f6153dd7ee45cc49d108300a"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/ash-project/ash/security/advisories/GHSA-vvp6-3wv6-833j"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://osv.dev/vulnerability/EEF-CVE-2026-70395"}], "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-943"}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.52.0-rc.11,3.31.1)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "ash", "source": "cna", "vendor": "ash-project"}, "product": "ash", "vendor": "ash-project"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[571c138140e71cea24005189f45d7a63c8d2ed20,09f42593035bceb0f6153dd7ee45cc49d108300a)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "ash", "source": "cna", "vendor": "ash-project"}, "product": "ash", "vendor": "ash-project"}], "created": "2026-08-09T19:30:04.878990+00:00", "updated": "2026-08-09T20:00:04.405905+00:00", "vendors": ["ash-project", "ash-project$PRODUCT$ash"]}