CVE-2026-101028

Estado: AplazadaMedia (6)—

Vulnerabilidad de Autorización Incorrecta en ash-project ash que permite a un actor inferir datos en registros relacionados que no puede leer a través de Ash.count/2, Ash.exists/2 y Ash.aggregate/3.

Ash.Actions.Aggregate.run/4 (lib/ash/actions/aggregate.ex) aplicaba únicamente la política de lectura del recurso raíz antes de ejecutar la consulta de agregación.

Leer descripción completaMostrar menos

La ruta de lectura también aplica la política de lectura de cada recurso relacionado para filtrar y ordenar referencias que cruzan una relación, directamente (por ejemplo comments.body) o a través de una agregación sobre uno, pero la ruta de agregación omitió ese paso. Un llamador cuyo filtro u ordenamiento alcanza estas funciones, por ejemplo a través de Ash.Query.filter_input/2, un script ash_lua, o una herramienta AshAi que ofrece resultados de count o exists, puede probar condiciones contra filas relacionadas ocultas para ellos y recuperar su existencia y valores de atributos una consulta a la vez. Ash.read/2 y sus recuentos de página no se ven afectados.

Este problema afecta a ash: desde 2.6.0 anterior a 3.34.6.

Traducción automática del texto original de NVD (en inglés).

CVSS

Versión: 4.0
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Puntuación base: 6

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.27%
Percentil entre todas las CVEs puntuadas: 18
Fecha de la puntuación: 14/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1210 Exploitation of Remote Serviceslateral movement75 %
Impacto principalT1526 Cloud Service Discoverydiscovery80 %
Impacto secundarioT1087 Account Discoverydiscovery70 %

Vulnerabilidad de autorización en servicio remoto Ash que requiere autenticación (PR:L) permitiendo inferir datos de registros relacionados ocultos mediante funciones de agregación. Acceso no autorizado a información sensible.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Vulnerability Scanning User Account Management Threat Intelligence Program Privileged Account Management Operating System Configuration Network Segmentation

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Ash-rs — ASH^AI

CWE

CWE-863

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2026-101028",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-101028",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-10-09T18:03:54.666261Z"
        }
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 6,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "LOW",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
          ],
          "repo": "https://github.com/ash-project/ash",
          "vendor": "ash-project",
          "modules": [
            "'Elixir.Ash.Actions.Aggregate'",
            "'Elixir.Ash'"
          ],
          "product": "ash",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.0",
              "lessThan": "3.34.6",
              "versionType": "semver"
            }
          ],
          "packageURL": "pkg:hex/ash",
          "packageName": "ash",
          "programFiles": [
            "lib/ash/actions/aggregate.ex",
            "lib/ash.ex"
          ],
          "collectionURL": "https://repo.hex.pm",
          "defaultStatus": "unaffected",
          "programRoutines": [
            {
              "name": "'Elixir.Ash.Actions.Aggregate':run/4"
            },
            {
              "name": "'Elixir.Ash':count/2"
            },
            {
              "name": "'Elixir.Ash':exists/2"
            },
            {
              "name": "'Elixir.Ash':aggregate/3"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
          ],
          "repo": "https://github.com/ash-project/ash",
          "vendor": "ash-project",
          "modules": [
            "'Elixir.Ash.Actions.Aggregate'",
            "'Elixir.Ash'"
          ],
          "product": "ash",
          "versions": [
            {
              "status": "affected",
              "version": "30eaf1c6e8524527b703e3c4bfeff7967ee0b37c",
              "lessThan": "80936187b27ee94f15cd875affd3141b5cb23185",
              "versionType": "git"
            }
          ],
          "packageURL": "pkg:github/ash-project/ash",
          "packageName": "ash-project/ash",
          "programFiles": [
            "lib/ash/actions/aggregate.ex",
            "lib/ash.ex"
          ],
          "collectionURL": "https://github.com",
          "defaultStatus": "unaffected",
          "programRoutines": [
            {
              "name": "'Elixir.Ash.Actions.Aggregate':run/4"
            },
            {
              "name": "'Elixir.Ash':count/2"
            },
            {
              "name": "'Elixir.Ash':exists/2"
            },
            {
              "name": "'Elixir.Ash':aggregate/3"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-10-09T07:17:17.627",
  "references": [
    {
      "url": "https://cna.erlef.org/cves/CVE-2026-101028.html",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/ash-project/ash/commit/30eaf1c6e8524527b703e3c4bfeff7967ee0b37c",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/ash-project/ash/commit/80936187b27ee94f15cd875affd3141b5cb23185",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/ash-project/ash/security/advisories/GHSA-xj24-8f5c-pp5p",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-101028",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/ash-project/ash/security/advisories/GHSA-xj24-8f5c-pp5p",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Incorrect Authorization vulnerability in ash-project ash allows an actor to infer data in related records they cannot read via Ash.count/2, Ash.exists/2 and Ash.aggregate/3.\n\nAsh.Actions.Aggregate.run/4 (lib/ash/actions/aggregate.ex) applied only the root resource's read policy before running the aggregate query. The read path also applies each related resource's read policy to filter and sort references that cross a relationship, directly (for example comments.body) or through an aggregate over one, but the aggregate path skipped that step. A caller whose filter or sort reaches these functions, for example through Ash.Query.filter_input/2, an ash_lua script, or an AshAi tool offering count or exists results, can test conditions against related rows hidden from them and recover their existence and attribute values one query at a time. Ash.read/2 and its page counts are not affected.\n\nThis issue affects ash: from 2.6.0 before 3.34.6."
    }
  ],
  "lastModified": "2026-10-09T18:17:01.197",
  "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
}