EEF-CVE-2026-77970 CVE-2026-77970 GHSA-v645-6jm6-cgpj
Sensitive fields nested in embedded values are not redacted in AshPaperTrail versions
- Severity
- 0.0 / 10
- Unknown · CVSS 4.0
- Exploit chance (EPSS)
- 0.12%
- Chance of exploitation in the next 30 days. Higher than 1.85% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-312 Cleartext Storage of Sensitive Information
- Fix
0.7.0- Upgrade ash_paper_trail to this version or later
Description
Summary
Cleartext Storage of Sensitive Information vulnerability in ash-project ash_paper_trail allows an attacker with read access to the generated version resource to recover sensitive values nested inside embedded resources, unions, or lists.
sensitive_attributes :redact and :ignore only act on the tracked resource's top-level attributes. maybe_redact_changes/3 and the stored-action-input path in AshPaperTrail.Resource.Changes.CreateNewVersion derive the sensitive set from the resource's own attributes and never descend into embedded, union, or list values, so a non-sensitive attribute or action argument that holds an embed with a sensitive? field (for example an accepted credentials embed carrying a token) is written to the version table in cleartext.
This issue affects ash_paper_trail: from 0.3.0 before 0.7.0.
Configurations
The resource must version an attribute or accept an action input whose type is an embedded resource, union, or list containing a sensitive? field, with sensitive_attributes set to :redact or :ignore. Exposure requires read access to the generated version resource.
Affected versions
Hex
| Package | Vulnerable | Fixed in |
|---|---|---|
| ash_paper_trail | >= 0.3.0, < 0.7.0 |
0.7.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
ash_paper_trail Hex → 0.7.0
- mix
{:ash_paper_trail, "~> 0.7.0"} # then: mix deps.update ash_paper_trail
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- Attack vector
- Local
- Attack complexity
- Low
- Attack requirements
- Present
- Privileges required
- None
- User interaction
- None
- Confidentiality (vulnerable system)
- High
- Integrity (vulnerable system)
- None
- Availability (vulnerable system)
- None
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
Weakness
CWE-312: Cleartext Storage of Sensitive Information
The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
How to prevent it
- Implementation, System Configuration, Operation: When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to encrypt the data at rest. [REF-1297] [REF-1299] [REF-1301]
- Implementation, System Configuration, Operation: In some systems/environments such as cloud, the use of "double encryption" (at both the software and hardware layer) might be required, and the developer might be solely responsible for both layers, instead of shared responsibility with the administrator of the broader system/environment.
References
Advisories
Fixes and patches
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| EEF-CVE-2026-77831 Algorithmic-complexity denial of service in AshPaperTrail full-diff list tracking | Not rated yet | Also affects ash_paper_trail |
| EEF-CVE-2026-75847 Sensitive attribute values stored in a non-sensitive public changes map in AshPaperTrail | Not rated yet | Also affects ash_paper_trail |
| GHSA-j7qq-vr8c-xvw3 MLflow CrewAI autologging records LLM provider API keys in logged trace spans | Medium | Same weakness, CWE-312 |
| GHSA-r6w9-259g-gwrv Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access | High | Same weakness, CWE-312 |
| GHSA-pvgv-gcp7-v38g Nginx UI: Node Secret Credential Exposure via URL Query Parameter | High | Same weakness, CWE-312 |
| GHSA-g5xv-mhgm-v5f6 MCP Atlassian: OAuth fallback token storage writes plaintext access and refresh tokens with group-readable permissions | Medium | Same weakness, CWE-312 |
| GHSA-88f6-4rjv-x774 Vikunja: TOTP secret is readable after enrollment, no step-up auth | Medium | Same weakness, CWE-312 |
| PYSEC-2026-3792 openssl_encrypt (pip package openssl-encrypt) versions 1.4.8 and earlier store an mTLS client private key in cleartext within a world-readable (0644)… | High | Same weakness, CWE-312 |
Credits: Jonatan Männchen / EEF, Peter Ullrich, Zach Daniel / Ash Project
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor