Ash Framework: OOM Cursor Bomb and Auth Bypass

The Erlang Ecosystem Foundation’s CNA published two advisories today for ash-project/ash, the Elixir data framework at the core of many Phoenix applications. The pair: CVE-2026-69659 (CVSS 4.0: 5.9 Medium, uncontrolled resource consumption) and CVE-2026-70395 (CVSS 4.0: 2.1 Low, improper neutralization in data query logic). Different severity levels, same answer: update Ash.

CVE-2026-69659: The cursor as a weapon

Read actions that use keyset pagination accept a page[:after] or page[:before] cursor from the client. In decode_values/2 (lib/ash/page/keyset.ex), Ash base64-decodes the cursor value and passes it directly to :erlang.binary_to_term/2 — with no bound on size. Erlang’s external term format supports zlib-compressed payloads; the runtime inflates them before parsing. A small cursor that expands into hundreds of megabytes on decode can exhaust node memory on contact.

The CNA scored this Medium (CVSS 4.0: 5.9) with Local attack vector and Attack Requirements: Present, which reflects that specific deployment conditions apply. In practical terms: any Ash application that exposes keyset-paginated read actions to untrusted callers has an OOM surface.

What to do: Upgrade Ash. While you’re staging the upgrade, identify which API endpoints accept keyset pagination parameters from unauthenticated or low-privilege callers. If you need a temporary measure, reject oversized cursor values at the edge — but that is a stopgap, not a fix.

CVE-2026-70395: Query injection through a managed relationship

When manage_relationship is configured with on_lookup: :relate on a belongs_to relationship, the client-supplied lookup value reaches Ash.Query.filter/2 without being cast to the attribute’s declared type first. Submitting a nested map where the code expects a scalar (e.g., a UUID) causes Ash to interpret the map as a filter expression rather than a literal ID. The result: an attacker can construct a query that matches records they should not be able to name and can recover the secret values used to look them up.

Authorization policies that gate record access are bypassed along this path. CVSS 4.0 puts this at Low (2.1), Local attack vector, Attack Requirements: Present. The business impact is proportional to what data lives behind those relationships and whether those endpoints are reachable by untrusted users.

What to do: Patch Ash. If you use manage_relationship with on_lookup: :relate on belongs_to, audit whether those endpoints are accessible to low-trust callers, and review whether your authorization policies cover the record lookup path specifically — not just the relationship creation step.

Priority

The OOM issue (CVE-2026-69659) has the lower exploitation bar: send a bad cursor, crash the node. Patch that first. The auth bypass (CVE-2026-70395) requires the attacker to understand the filter syntax and have access to a manage_relationship endpoint, which reduces the immediate exposure, but it touches authorization — which is exactly the kind of thing that bites you quietly.

Both advisories are from ERLEF’s CNA. NVD entries: CVE-2026-69659, CVE-2026-70395.