EEF-CVE-2026-78038 CVE-2026-78038 GHSA-gj9p-x393-rf9h
Job argument injection via :args overrides primary_key and tenant in AshOban
- Severity
- 0.0 / 10
- Unknown · CVSS 4.0
- Exploit chance (EPSS)
- 0.38%
- Chance of exploitation in the next 30 days. Higher than 31.73% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes
- Fix
0.8.14- Upgrade ash_oban to this version or later
Description
Summary
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash_oban allows a user whose input reaches the :args option of AshOban.build_trigger/3 to retarget an update or destroy trigger at another record, including across tenants.
build_trigger/3 builds the trusted job arguments with atom keys (:primary_key, :tenant, :action_arguments) and merges the caller's :args underneath so the trusted values win on collision. Because Oban job arguments round-trip through JSON, the caller's keys arrive as strings, so Map.merge sees no collision and both keys survive. When the job is persisted the JSON object is de-duplicated keeping the last (string) key, and the worker reads the caller's value. The documentation describes :args as unable to affect the action, so an application that forwards user input into it for uniqueness scoping is exposed to authorization bypass and tenant isolation breaks.
This issue affects ash_oban: from 0.2.5 before 0.8.14.
Configurations
An application must pass untrusted input into the :args option of AshOban.build_trigger/3 (or an equivalent scheduling helper), on a trigger whose action is an update or destroy, so that an injected primary_key, tenant, or action_arguments retargets the enqueued job.
Affected versions
Hex
| Package | Vulnerable | Fixed in |
|---|---|---|
| ash_oban | >= 0.2.5, < 0.8.14 |
0.8.14 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
ash_oban Hex → 0.8.14
- mix
{:ash_oban, "~> 0.8.14"} # then: mix deps.update ash_oban
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
- Attack vector
- Local
- Attack complexity
- Low
- Attack requirements
- Present
- Privileges required
- None
- User interaction
- None
- Confidentiality (vulnerable system)
- Low
- Integrity (vulnerable system)
- High
- Availability (vulnerable system)
- None
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
Weakness
CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes
The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.
How to prevent it
- Implementation: If available, use features of the language or framework that allow specification of allowlists of attributes or fields that are allowed to be modified. If possible, prefer allowlists over denylists. For applications written with Ruby on Rails, use the attr_accessible (allowlist) or attr_protected (denylist) macros in each class that may be used in mass assignment.
- Architecture and Design, Implementation: If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
- Implementation: For any externally-influenced input, check the input against an allowlist of internal object attributes or fields that are allowed to be modified.
- Implementation, Architecture and Design: Refactor the code so that object attributes or fields do not need to be dynamically identified, and only expose getter/setter functionality for the intended attributes.
References
Advisories
Fixes and patches
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| EEF-CVE-2026-78228 Unbounded handle_error recursion enables denial of service in AshOban triggers | Not rated yet | Also affects ash_oban |
| GHSA-66wr-7vmr-p5jq Payload authentication token field handling issue | Critical | Same weakness, CWE-915 |
| EEF-CVE-2026-93477 Private action arguments can be set by user input on the bulk destroy and bulk update paths in Ash | Not rated yet | Same weakness, CWE-915 |
| GHSA-gx83-3vf8-gh7j jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist) | Medium | Same weakness, CWE-915 |
| GHSA-265m-7826-wjqm Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass | High | Same weakness, CWE-915 |
| GHSA-6vh2-wg4h-4vwj Flowise: Unauthenticated Property Injection into Flow Execution Context via Ungated `overrideConfig` Spread in Prediction API | Critical | Same weakness, CWE-915 |
| GHSA-vmjq-hvgq-2wv4 9router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade | High | Same weakness, CWE-915 |
| GHSA-3pjw-73gf-8qr5 jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy | Medium | Same weakness, CWE-915 |
Credits: Jonatan Männchen / EEF, Peter Ullrich, Zach Daniel / Ash Project
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor