TI-2026-54287 Aliases CVE-2026-78038

Job argument injection via :args overrides primary_key and tenant in AshOban

MEDIUM 60CWE-915Published 2026-08-30 · Updated 2026-08-31

Key facts

Attack vector: Local
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: Present
Impact type: Tampering
Confidentiality · integrity · availability: Low · High · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-915.

Summary

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash_oban allows a user whose input reaches the :args option of AshOban.build_trigger/3 to retarget an update or destroy trigger at another record, including across tenants. build_trigger/3 builds the trusted job arguments with atom keys (:primary_key, :tenant, :action_arguments) and merges the caller's :args underneath so the trusted values win on collision. Because Oban job arguments round-trip through JSON, the caller's keys arrive as strings, so Map.merge sees no collision and both keys survive. When the job is persisted the JSON object is de-duplicated keeping the last (string) key, and the worker reads the caller's value. The documentation describes :args as unable to affect the action, so an application that forwards user input into it for uniqueness scoping is exposed to authorization bypass and tenant isolation breaks. This issue affects ash_oban: from 0.2.5 before 0.8.14.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00377 31st percentileScored 2026-11-07

Fix Fixed ash_oban (ash-project): 0.8.14

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
ash-project	ash_oban	0.2.5 to before 0.8.14	0.8.14	Patch available	CNA

ash_oban Vendorash-project Affected 0.2.5 to before 0.8.14 Fixed in 0.8.14 Patch available CNA

CPE names CNA · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:ash-project:ash_oban::::::::	—	—	—

cpe:2.3:a:ash-project:ash_oban:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

Fix · CNA ash_oban (ash-project) Fixed in 0.8.14

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-08-30
ash-project ash_oban 0.8.14
2 records Highest priority Priority MEDIUM 2 MEDIUM
Other records, highest priority first
- TI-2026-54408 Unbounded handle_error recursion enables denial of service in AshOban triggersPriority MEDIUM 60
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2026-78038

References

Patch 1

https://github.com/ash-project/ash_oban/commit/da2d81e1e8e1dcc3e6ec8587cdb4f273575ffca3

Advisory 1

https://github.com/ash-project/ash_oban/security/advisories/GHSA-gj9p-x393-rf9h

Other 2

TI-2026-56298 Query-complexity limit bypass via first/last pagination arguments in AshGraphql enables denial of service CVSS 4.0HIGH 8.7
TI-2026-52572 Unbounded atom creation from client-supplied RPC field names in AshTypescript field formatter CVSS 4.0HIGH 8.7
TI-2026-57010 Path traversal in AshAdmin file uploads via unsanitized client filename CVSS 4.0HIGH 8.3
TI-2026-26840 Ash Framework: Ash.Type.Module.cast_input/2 atom exhaustion via unchecked Module.concat allows BEAM VM crash CVSS 4.0HIGH 8.2
TI-2026-54252 EEx template evaluation of prompt content in AshAi enables remote code execution CVSS 4.0HIGH 8.9
TI-2026-54208 Stored XSS in AshAdmin relationship typeahead via unescaped label_field content CVSS 4.0HIGH 8.4

See all 90 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences