CVE-2026-94206

Estado: AplazadaMedia (6.3)—

Use of Password Hash With Insufficient Computational Effort vulnerability in danielberkompas cloak_ecto and danielberkompas cloak allows an attacker who holds the hashed values and the configured secret to brute-force low-entropy plaintexts much faster than configured.

The dump/1 callback that Cloak.Ecto.PBKDF2 (Cloak.Fields.PBKDF2 in cloak before the Ecto code moved to cloak_ecto) injects into a field module calls :pbkdf2.pbkdf2/4 with config[:size] in the iteration-count position. The :iterations setting is validated but never used. With the cloak_ecto defaults (iterations: 600_000, size: 32) each hash runs 32 PBKDF2 rounds instead of 600,000, so offline guessing of values such as email addresses costs about 18,750 times less than configured.

Leer descripción completaMostrar menos

This issue affects cloak_ecto: from 1.0.0-alpha.0 onward; cloak: from 0.7.0 before 1.0.0-alpha.0.

CVSS

Versión: 4.0
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Puntuación base: 6.3

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.26%
Percentil entre todas las CVEs puntuadas: 16
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1190 Exploit Public-Facing Applicationinitial access45 %
Impacto principalT1552.007 Container APIcredential access75 %
Impacto secundarioT1078.001 Default Accountsstealth · persistence · privilege escalation · initial access60 %

AV:N, PR:N indica ataque remoto sin privilegios (T1190), pero requiere acceso previo a hashes. CWE-916 (insuficiente esfuerzo computacional) permite recuperar contraseñas/secretos mediante fuerza bruta offline (T1552.007) para comprometer cuentas (T1078.001).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account Management Network Segmentation Limit Access to Resource Over Network Vulnerability Scanning User Account Management Password Policies

Tecnologías afectadas (2)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Danielberkompas — Cloak^AI Danielberkompas — Cloak Ecto^AI

CWE

CWE-916

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2026-94206",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-94206",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-10-06T11:34:00.942993Z"
        }
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 6.3,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "LOW",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:danielberkompas:cloak_ecto:*:*:*:*:*:*:*:*"
          ],
          "repo": "https://github.com/danielberkompas/cloak_ecto",
          "vendor": "danielberkompas",
          "modules": [
            "'Elixir.Cloak.Ecto.PBKDF2'"
          ],
          "product": "cloak_ecto",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0-alpha.0",
              "lessThan": "*",
              "versionType": "semver"
            }
          ],
          "packageURL": "pkg:hex/cloak_ecto",
          "packageName": "cloak_ecto",
          "programFiles": [
            "lib/cloak_ecto/types/pbkdf2.ex"
          ],
          "collectionURL": "https://repo.hex.pm",
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:2.3:a:danielberkompas:cloak_ecto:*:*:*:*:*:*:*:*"
          ],
          "repo": "https://github.com/danielberkompas/cloak_ecto",
          "vendor": "danielberkompas",
          "modules": [
            "'Elixir.Cloak.Ecto.PBKDF2'"
          ],
          "product": "cloak_ecto",
          "versions": [
            {
              "status": "affected",
              "version": "a8fa1642b02f1c445a1ee8794c9095eb0921f8f3",
              "lessThan": "*",
              "versionType": "git"
            }
          ],
          "packageURL": "pkg:github/danielberkompas/cloak_ecto",
          "packageName": "danielberkompas/cloak_ecto",
          "programFiles": [
            "lib/cloak_ecto/types/pbkdf2.ex"
          ],
          "collectionURL": "https://github.com",
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:2.3:a:danielberkompas:cloak:*:*:*:*:*:*:*:*"
          ],
          "repo": "https://github.com/danielberkompas/cloak",
          "vendor": "danielberkompas",
          "modules": [
            "'Elixir.Cloak.Fields.PBKDF2'"
          ],
          "product": "cloak",
          "versions": [
            {
              "status": "affected",
              "version": "0.7.0",
              "lessThan": "1.0.0-alpha.0",
              "versionType": "semver"
            }
          ],
          "packageURL": "pkg:hex/cloak",
          "packageName": "cloak",
          "programFiles": [
            "lib/cloak/fields/pbkdf2.ex"
          ],
          "collectionURL": "https://repo.hex.pm",
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:2.3:a:danielberkompas:cloak:*:*:*:*:*:*:*:*"
          ],
          "repo": "https://github.com/danielberkompas/cloak",
          "vendor": "danielberkompas",
          "modules": [
            "'Elixir.Cloak.Fields.PBKDF2'"
          ],
          "product": "cloak",
          "versions": [
            {
              "status": "affected",
              "version": "8699e6417a162c39d9f0ef63511bd23d3f38d1d2",
              "lessThan": "681c9702b7cd9afe0e5a840751ab009f550c69a9",
              "versionType": "git"
            }
          ],
          "packageURL": "pkg:github/danielberkompas/cloak",
          "packageName": "danielberkompas/cloak",
          "programFiles": [
            "lib/cloak/fields/pbkdf2.ex"
          ],
          "collectionURL": "https://github.com",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-10-06T09:17:56.813",
  "references": [
    {
      "url": "https://cna.erlef.org/cves/CVE-2026-94206.html",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/danielberkompas/cloak/commit/681c9702b7cd9afe0e5a840751ab009f550c69a9",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/danielberkompas/cloak/commit/8699e6417a162c39d9f0ef63511bd23d3f38d1d2",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/danielberkompas/cloak_ecto/commit/a8fa1642b02f1c445a1ee8794c9095eb0921f8f3",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-94206",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "description": [
        {
          "lang": "en",
          "value": "CWE-916"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Use of Password Hash With Insufficient Computational Effort vulnerability in danielberkompas cloak_ecto and danielberkompas cloak allows an attacker who holds the hashed values and the configured secret to brute-force low-entropy plaintexts much faster than configured.\n\nThe dump/1 callback that Cloak.Ecto.PBKDF2 (Cloak.Fields.PBKDF2 in cloak before the Ecto code moved to cloak_ecto) injects into a field module calls :pbkdf2.pbkdf2/4 with config[:size] in the iteration-count position. The :iterations setting is validated but never used. With the cloak_ecto defaults (iterations: 600_000, size: 32) each hash runs 32 PBKDF2 rounds instead of 600,000, so offline guessing of values such as email addresses costs about 18,750 times less than configured.\n\nThis issue affects cloak_ecto: from 1.0.0-alpha.0 onward; cloak: from 0.7.0 before 1.0.0-alpha.0."
    }
  ],
  "lastModified": "2026-10-06T15:03:59.427",
  "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
}