{"answers":{"affected":"2 open source packages ship an affected version, including cloak and cloak_ecto.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-94206 exists.","fix":"Upgrade cloak to 1.0.0-alpha.0 or later.","what":"CVE-2026-94206 is a medium-severity vulnerability in danielberkompas cloak, published on 6 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-94206 and fix it if it is affected.\n\nWhat it is: CVE-2026-94206 is a medium-severity vulnerability in danielberkompas cloak, published on 6 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-94206 exists.\n\nAffected packages and fixed versions:\n- cloak (Hex): affected from 0.7.0; fixed in 1.0.0-alpha.0\n- cloak_ecto (Hex): affected from 1.0.0-alpha.0; no fix listed\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-94206/ (Markdown: https://insights.sbomify.com/CVE-2026-94206/index.md)","id":"CVE-2026-94206","markdown":"https://insights.sbomify.com/CVE-2026-94206/index.md","name":"CVE-2026-94206","record":{"aliases":["EEF-CVE-2026-94206","GHSA-fjfg-jh7h-6w3j"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["data_read"],"network_reachable":"yes","non_default_config":false,"product_category":"Elixir encryption library","requires_auth":"none","summary":"The Cloak library ignores configured PBKDF2 iterations, using a low count that allows attackers to brute-force hashed passwords much faster than intended.","user_interaction":"not_required","vuln_class":"weak_cryptography"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"EEF","cpe":[],"cvss":{"score":6.3,"severity":"medium","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-916","name":"Use of Password Hash With Insufficient Computational Effort"}],"description":"Use of Password Hash With Insufficient Computational Effort vulnerability in danielberkompas cloak_ecto and danielberkompas cloak allows an attacker who holds the hashed values and the configured secret to brute-force low-entropy plaintexts much faster than configured.\n\nThe dump/1 callback that Cloak.Ecto.PBKDF2 (Cloak.Fields.PBKDF2 in cloak before the Ecto code moved to cloak_ecto) injects into a field module calls :pbkdf2.pbkdf2/4 with config[:size] in the iteration-count position. The :iterations setting is validated but never used. With the cloak_ecto defaults (iterations: 600_000, size: 32) each hash runs 32 PBKDF2 rounds instead of 600,000, so offline guessing of values such as email addresses costs about 18,750 times less than configured.\n\nThis issue affects cloak_ecto: from 1.0.0-alpha.0 onward; cloak: from 0.7.0 before 1.0.0-alpha.0.","ecosystems":["Hex"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":true,"headline":"Cloak PBKDF2 field ignores the configured iteration count and runs only :size rounds","id":"CVE-2026-94206","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Hex","product":null,"products":[],"type":"weak_cryptography","year":"2026"},"n_packages":2,"n_references":5,"next":{"headline":"Hyve5 Leantime Kanban Board Tickets.php getAllGrouped cross site scripting","id":"CVE-2026-94210"},"packages":[{"ecosystem":"Hex","fixed":["1.0.0-alpha.0"],"introduced":["0.7.0"],"last_affected":[],"package":"cloak","purl":"pkg:hex/cloak","source":"EEF-CVE-2026-94206"},{"ecosystem":"Hex","fixed":[],"introduced":["1.0.0-alpha.0"],"last_affected":[],"package":"cloak_ecto","purl":"pkg:hex/cloak_ecto","source":"EEF-CVE-2026-94206"}],"prev":{"headline":"Gitea fork workflow approval bypass through maintainer-triggered events","id":"CVE-2026-94205"},"products":["cloak","cloak_ecto"],"published":"2026-10-06","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"Erlang Ecosystem Foundation","prefix":"EEF"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"poc","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-10-06","vendors":["danielberkompas"]},"summary":"The Cloak library ignores configured PBKDF2 iterations, using a low count that allows attackers to brute-force hashed passwords much faster than intended.","url":"https://insights.sbomify.com/CVE-2026-94206/"}