CVE-2026-82367

Exposure of Data Element to Wrong Session vulnerability in ash-project ash_graphql can deliver one subscription's resolved records to a different subscriber's topic. AshGraphql.Subscription.Batcher.do_send/5 reads the resolved batch from the process dictionary via Process.get(:batch_resolved) and then unconditionally deletes it. That is sound only inside a task the library owns. On the :backpressure_sync and :noproc fallbacks do_send/5 runs inline in the publishing caller's process, so if a resolver inside an outer do_send/5 triggers another synchronous Ash notification, the inner call finds the outer run's value still under :batch_resolved, adopts it as its own result, and publishes it to the inner topic, a different subscription document with a different actor and tenant. It then deletes the key, so the outer run publishes nothing. The key is not namespaced by run, so records cannot be told apart. The fix saves, clears, and restores :batch_resolved around each run. This issue affects ash_graphql: from 1.4.0 before 1.11.0.

• CWE-488

• https://cna.erlef.org/cves/CVE-2026-82367.html
• https://github.com/ash-project/ash_graphql/commit/b798ef5288664a0261990b19765558f168b718fb
• https://github.com/ash-project/ash_graphql/security/advisories/GHSA-wm4m-cjmc-5v8c
• https://osv.dev/vulnerability/EEF-CVE-2026-82367
• https://github.com/ash-project/ash_graphql/security/advisories/GHSA-wm4m-cjmc-5v8c

Published

Aug 30, 2026

Last Modified

Sep 1, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-82355When a request to the Airflow core API carries both a sessio…4.2
• CVE-2026-82356Imprivata EAM <=26.2.6 lacks the ability to rotate its RSA k…7.5
• CVE-2026-82357RT-Labs AB C-Open CANopen contains a NULL pointer dereferenc…6.5
• CVE-2026-82358RT-Labs AB C-Open CANopen contains a write protection bypass…6.5
• CVE-2026-8236Concrete CMS 9.5.0 and below is vulnerable to IDOR combined …4.3
• CVE-2026-82364A security vulnerability has been detected in macrozheng mal…4.2
• CVE-2026-82368Insecure access controls on internal service ports in Brocad…8.7
• CVE-2026-82369Insufficient input sanitization of shell metacharacters in t…8.6
• CVE-2026-8237Concrete CMS 9.5.0 and below is vulnerable to IDOR. The `/cc…5.3
• CVE-2026-82370Unauthenticated remote command injection in the Brocade SANn…8.6
• CVE-2026-82371Plaintext exposure of sensitive authentication data in Broca…8.5
• CVE-2026-82372Improper handling of sensitive data during IPsec policy crea…8.5