Six ash_graphql Vulnerabilities: Query, Subscription, and Error Boundaries

ash_graphql is the GraphQL integration used by applications built on the Elixir Ash framework. Release 1.11.0, published on August 30, 2026, fixes six security issues spread across query analysis, Relay node handling, subscription delivery, and error responses. Treating them as one generic package update would miss the deployment conditions that make each issue relevant.

The affected ranges differ. CVE-2026-81636 affects 0.16.23 through versions before 1.11.0, CVE-2026-81633 starts at 0.27.0, and CVE-2026-78693 starts at 1.9.0. The three subscription flaws are also fixed in 1.11.0, while their practical exposure depends on whether the application enables subscriptions, multitenancy, batching, or re-entrant publishing.

Where the six flaws sit

CVE-2026-81636 lets Relay or keyset pagination arguments such as first and last escape the intended query-complexity accounting. A small-looking nested query can therefore drive much more database work than the analyzer reports, leading to resource exhaustion. CVE-2026-81633 covers an unknown Relay node type that could raise an exception instead of returning a controlled GraphQL error.

CVE-2026-80223 is a cross-tenant subscription disclosure condition. The resolver authorized notification payloads in memory without performing a tenant-scoped read, allowing an authenticated subscriber in one tenant to receive another tenant's record under the documented conditions. CVE-2026-81643 is related but focuses on batched notifications: authorization filtering was not applied consistently to every record in the batch.

CVE-2026-82367 concerns synchronous re-entrant publishing. A process key used to store resolved subscription results was not sufficiently isolated, allowing results from different topics to become confused. CVE-2026-78693 affects redaction: ash_graphql could reattach the original error path after a custom error handler removed it, exposing internal field names in GraphQL errors.

Exposure questions

• Does the production artifact resolve ash_graphql to a version before 1.11.0?
• Does the schema expose Relay or keyset pagination and rely on complexity limits?
• Are subscriptions enabled for multitenant resources or batched notifications?
• Can a subscription event synchronously trigger another publication?
• Does a custom error handler remove internal field names or response paths?

Review the resolved dependency in the lock file and in the deployed artifact, not only the manifest constraint. A rebuilt container or release bundle must actually contain the updated package. Applications that do not use one affected feature have a smaller direct path for that specific issue, but the common fixed release remains the clearest operational baseline.

Update and validation

The official fix is ash_graphql 1.11.0. Network request limits can reduce pressure before rollout, but they do not repair the library's complexity calculation, subscription authorization, process-key isolation, or error redaction. Apply the fixed release, rebuild the artifact, and validate the security properties that matter to the application.

1. Confirm the resolved ash_graphql version in production lock files and artifacts.
2. Apply the official fixed release and rebuild every affected deployment artifact.
3. Test nested Relay pagination against configured complexity and page-size limits.
4. Verify single and batched subscriptions with records from at least two tenants.
5. Test re-entrant publication, unknown Relay node types, and sanitized error paths.
6. Monitor GraphQL error rates, latency, database reads, and subscription delivery after rollout.

Regression tests should confirm defensive outcomes without reproducing exploit payloads. Large Relay requests should meet the intended complexity controls, cross-tenant records should never reach the wrong subscriber, every item in a batch should receive authorization filtering, and fields removed by the error handler should stay out of the response.

Operational follow-through

The update may make previously accepted Relay requests fail under stricter complexity accounting or reveal policy gaps that were hidden by incomplete subscription filtering. Use those signals to tune page limits and authorization policies rather than reverting the fix. Observe both the GraphQL response layer and the subscription transport so tenant identifiers and records remain aligned.

These six issues share a boundary theme: the analyzer versus actual work, the subscriber tenant versus notification records, the first batch item versus the rest, and the custom error handler versus the final response. Testing those boundaries alongside the package upgrade is what turns the release into an effective security change.