CVE-2026-94206 Cloak PBKDF2 field ignores the configured iteration count and runs only :size rounds
The Cloak library ignores configured PBKDF2 iterations, using a low count that allows attackers to brute-force hashed passwords much faster than intended.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-94206?
CVE-2026-94206 is a medium-severity vulnerability in danielberkompas cloak, published on 6 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Use of Password Hash With Insufficient Computational Effort vulnerability in danielberkompas cloak_ecto and danielberkompas cloak allows an attacker who holds the hashed values and the configured secret to brute-force low-entropy plaintexts much faster than configured.
The dump/1 callback that Cloak.Ecto.PBKDF2 (Cloak.Fields.PBKDF2 in cloak before the Ecto code moved to cloak_ecto) injects into a field module calls :pbkdf2.pbkdf2/4 with config[:size] in the iteration-count position. The :iterations setting is validated but never used. With the cloak_ecto defaults (iterations: 600_000, size: 32) each hash runs 32 PBKDF2 rounds instead of 600,000, so offline guessing of values such as email addresses costs about 18,750 times less than configured.
This issue affects cloak_ecto: from 1.0.0-alpha.0 onward; cloak: from 0.7.0 before 1.0.0-alpha.0.
Weakness: CWE-916
Which versions are affected by CVE-2026-94206?
2 open source packages ship an affected version, including cloak and cloak_ecto.
| Package | Affected | Fixed in |
|---|---|---|
cloak Hex | From 0.7.0 | 1.0.0-alpha.0 |
cloak_ecto Hex | From 1.0.0-alpha.0 | None |
How do I fix CVE-2026-94206?
Upgrade cloak to 1.0.0-alpha.0 or later.
Is CVE-2026-94206 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-94206 exists.
Sources
Also known as EEF-CVE-2026-94206, GHSA-fjfg-jh7h-6w3j.