CVE-2026-82367

Exposure of Data Element to Wrong Session vulnerability in ash-project ash_graphql can deliver one subscription's resolved records to a different subscriber's topic. AshGraphql.Subscription.Batcher.do_send/5 reads the resolved batch from the process dictionary via Process.get(:batch_resolved) and then unconditionally deletes it. That is sound only inside a task the library owns. On the :backpressure_sync and :noproc fallbacks do_send/5 runs inline in the publishing caller's process, so if a resolver inside an outer do_send/5 triggers another synchronous Ash notification, the inner call finds the outer run's value still under :batch_resolved, adopts it as its own result, and publishes it to the inner topic, a different subscription document with a different actor and tenant. It then deletes the key, so the outer run publishes nothing. The key is not namespaced by run, so records cannot be told apart. The fix saves, clears, and restores :batch_resolved around each run. This issue affects ash_graphql: from 1.4.0 before 1.11.0.

• CWE-488

• https://cna.erlef.org/cves/CVE-2026-82367.html
• https://github.com/ash-project/ash_graphql/commit/b798ef5288664a0261990b19765558f168b718fb
• https://github.com/ash-project/ash_graphql/security/advisories/GHSA-wm4m-cjmc-5v8c
• https://osv.dev/vulnerability/EEF-CVE-2026-82367
• https://github.com/ash-project/ash_graphql/security/advisories/GHSA-wm4m-cjmc-5v8c

Published

Aug 30, 2026

Last Modified

Sep 1, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-8234A security vulnerability has been detected in EFM ipTIME A80…8.8
• CVE-2026-82343A flaw was found in the file-psd plugin in GIMP. When proces…6.1
• CVE-2026-82346A potential security vulnerability has been identified in th…7
• CVE-2026-8235A vulnerability was detected in 8421bit MiniClaw 0.8.0/0.9.0…5.5
• CVE-2026-8236Concrete CMS 9.5.0 and below is vulnerable to IDOR combined …4.3
• CVE-2026-82364A security vulnerability has been detected in macrozheng mal…4.2
• CVE-2026-8237Concrete CMS 9.5.0 and below is vulnerable to IDOR. The `/cc…5.3
• CVE-2026-8238Concrete CMS 9.5.0 and below is vulnerable to IDOR. The '/cc…5.3
• CVE-2026-8239Concrete CMS 9.5.0 and below is vulnerable to IDOR. The '/cc…5.3
• CVE-2026-82392pnpm is a package manager. Prior to 10.34.5 and from 11.0.0 …7.1
• CVE-2026-82393pnpm is a package manager. Prior to 10.34.5 and 11.11.0, pnp…7.5
• CVE-2026-82394Sulu is an open-source PHP content management system based o…5.3