CVE-2026-70395 Predicate injection in manage_relationship belongs_to lookup discloses secret lookup keys in Ash
Attackers can inject filter predicates into relationship lookups to recover secret lookup keys via an oracle, exposing sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-70395?
CVE-2026-70395 is a low-severity SQL injection vulnerability in ash-project ash, published on 9 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash allows an attacker to forge a relationship to a record they cannot name, and to recover the secret value used to look it up.
When manage_relationship is used with on_lookup: :relate on a belongs_to relationship, the client-supplied lookup value is passed to Ash.Query.filter/2 without being cast to the attribute type. A nested map submitted where a scalar is expected is therefore interpreted as a filter predicate rather than a literal, so a lookup for a specific record becomes a query for any record matching a condition. The same path omits Ash.Query.limit(1), leaving Ash.read_one/2 able to distinguish no match from one match from several, which turns comparison predicates into an oracle for the lookup value. Authorization is unaffected; the destination read policy still applies.
This issue affects ash: from 1.52.0-rc.11 before 3.31.1.
Weakness: CWE-943
Which versions are affected by CVE-2026-70395?
1 open source package ship an affected version, including ash.
| Package | Affected | Fixed in |
|---|---|---|
ash Hex | From 1.52.0-rc.11 | 3.31.1 |
How do I fix CVE-2026-70395?
Upgrade ash to 3.31.1 or later.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-70395 being exploited?
There is no known exploitation of CVE-2026-70395 in the wild and no public exploit code.
Sources
Also known as EEF-CVE-2026-70395, GHSA-vvp6-3wv6-833j.