CVE-2026-81322

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ash-project ash_cloak allows anyone with access to logs, error trackers, or crash reports, or anyone who can trigger a validation error, to recover the plaintext of a field the library encrypts. AshCloak.Transformers.SetUpEncryption removes each cloaked attribute from the action's accept list and adds an action argument that carries the plaintext into the encryption change. That argument is built with sensitive?: attr.sensitive?, inheriting the flag from the source attribute, so a cloaked attribute declared without sensitive? true produces a non-sensitive argument. It is the only place the cleartext value lives, and the one place Ash will not redact: it appears verbatim in inspect(changeset), Ash.Error.Invalid and validation error messages, telemetry, :sys dumps, and error-tracker payloads. The generated encrypted attribute and decrypt calculation are already hardcoded sensitive. This issue affects ash_cloak: from 0.1.0 before 0.4.0.

• CWE-200

• https://cna.erlef.org/cves/CVE-2026-81322.html
• https://github.com/ash-project/ash_cloak/commit/ef49cfc832329fc8bc70ec6542a4dfff5dafd076
• https://github.com/ash-project/ash_cloak/security/advisories/GHSA-qp4v-vvrg-8ggx
• https://osv.dev/vulnerability/EEF-CVE-2026-81322
• https://github.com/ash-project/ash_cloak/security/advisories/GHSA-qp4v-vvrg-8ggx

Published

Aug 30, 2026

Last Modified

Sep 1, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-81315Origin Validation Error vulnerability in ash-project ash_ai …7.4
• CVE-2026-81316Incorrect Authorization vulnerability in ash-project ash_sql…2.1
• CVE-2026-81318Incorrect Authorization vulnerability in ash-project ash_sql…2.1
• CVE-2026-81319Deserialization of Untrusted Data vulnerability in ash-proje…5.9
• CVE-2026-8132A weakness has been identified in CodeAstro Leave Management…7.3
• CVE-2026-81320A flaw was found in hawtio-operator. When a custom Route TLS…5.5
• CVE-2026-81326QND uses a hard-coded cryptographic key, which may allow a l…6.8
• CVE-2026-8133A security vulnerability has been detected in zyx0814 FilePr…7.3
• CVE-2026-81330The C6 ear camera transmits live video to the EarVision Andr…6.5
• CVE-2026-81334darknet subscripts its layer array with an index taken from …6.1
• CVE-2026-81335Baserow dispatches an Application Builder data source withou…7.5
• CVE-2026-8134Concrete CMS 9.5.0 and below fails to sanitize path traversa…7.2