What’s Vulnerable › Products

ash-project ash_graphql vulnerabilities

6 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 6 published in the last 12 months.

Check whether your ash-project ash_graphql version is affected

Latest ash-project ash_graphql vulnerabilities

• CVE-2026-82367 — Re-entrant synchronous publish in AshGraphql subscription batcher delivers one subscriber's records to another's topic (CVSS 2.3)
• CVE-2026-81643 — Broken access control in AshGraphql subscription batcher applies authorization suppression to only the first notification (CVSS 2.3)
• CVE-2026-81636 — Query-complexity limit bypass via first/last pagination arguments in AshGraphql enables denial of service (CVSS 8.7)
• CVE-2026-81633 — Unhandled KeyError in AshGraphql relay node resolution crashes queries via an unknown type segment (CVSS 6.9)
• CVE-2026-80223 — Cross-tenant subscription disclosure in AshGraphql authorizes notifications in memory without a tenant-scoped read (CVSS 7.1)
• CVE-2026-78693 — Incomplete redaction re-attaches the original error path in AshGraphql, leaking internal field names (CVSS 6.9)