August 31 Security Briefing: ash_graphql, Open5GS and AJCloud Fixes

Today’s Security Priorities

This briefing covers three product families whose new CVE records were published within the research window and could be matched to a fixed version. ash_graphql received six coordinated disclosures spanning GraphQL complexity accounting, multitenant subscriptions, relay input handling, and error-path redaction. Two Open5GS records document flaws in AMF processing of UE context data and N1-N2 messages. A new AJCloud record identifies an unauthenticated path traversal in camera firmware that can expose sensitive configuration files.

Although all three issues sit at network input boundaries, the operational response differs. ash_graphql teams need to review both the package version and subscription configuration. Open5GS operators should plan a core-network upgrade and validate signaling after deployment. AJCloud camera owners should verify the firmware first, then rotate device and Wi-Fi credentials after updating. Exposure and asset role matter more than comparing scores alone.

Issues at a Glance

• ash_graphql 1.11.0 fixes CVE-2026-81636, CVE-2026-80223, CVE-2026-81633, CVE-2026-78693, CVE-2026-81643, and CVE-2026-82367.
• Open5GS 2.8.0 is listed as unaffected by CVE-2026-82587 and CVE-2026-82589, which affect releases 2.7.0 through 2.7.7.
• AJCloud AJY IPC firmware before 01.10715.11.37 is affected by CVE-2026-56718, an unauthenticated path traversal in jdbhttpd.

New Major CVEs

ash_graphql 1.11.0 Security Fixes

The ash_graphql 1.11.0 release lists fixes for all six newly published CVEs. CVE-2026-81636 carries the highest priority: in versions 0.16.23 through 1.10.x, first and last pagination arguments were not included correctly in GraphQL complexity calculations. An unauthenticated request could therefore pass the configured limit while forcing a large database read. The official record rates the issue 8.7 under CVSS v4. The fix accounts for first and last and clamps them to the action page size.

CVE-2026-80223 affects multitenant subscriptions from 1.4.0 and can deliver records across tenant boundaries. CVE-2026-81643 concerns authorization of batched notifications, while CVE-2026-82367 addresses re-entrant synchronous publishing that can mix subscription topics. CVE-2026-81633 turns an unknown Relay node type into an unhandled exception in releases from 0.27.0. CVE-2026-78693 affects versions from 1.9.0 and can reattach internal field names that an application attempted to redact from an error path.

Check the deployed ash_graphql version in mix.lock or the resolved dependency inventory and plan an upgrade to 1.11.0 or later. Before changing production, record complexity settings, multitenant resources, subscription use, and any custom error handler. Regression tests should confirm that large nested first/last queries are limited, tenant A cannot receive tenant B events, malformed Relay node requests return a normal GraphQL error, and redacted internal field names do not reappear.

Two Open5GS AMF Vulnerabilities

CVE-2026-82587 affects Open5GS 2.7.0 through 2.7.7 when the AMF decodes allowedNssai data in a UE context list, potentially causing memory corruption. CVE-2026-82589 affects the N1-N2 Message Handler and can cause denial of service through the ngapIeType field. Both records identify 2.8.0 as unaffected and reference the same corrective commit.

The important timing distinction is that version 2.8.0 itself predates this research window. The new CVE records published during the window connect the affected range and vulnerable functions to that existing release. Operators should verify the actual Open5GS version in packages, images, or container tags instead of assuming a recently deployed 2.7.x build is covered.

Back up AMF configuration, subscriber integration settings, and deployment image tags before upgrading. Test version 2.8.0 or later in a staging environment, then validate UE registration, session establishment, N1-N2 transfers, and gNB connect and release flows. After production deployment, compare process state, container restart counts, latency, and failure rates with the pre-change baseline. Restrict access to AMF service and management interfaces to required network functions.

AJCloud Camera Firmware Path Traversal

CVE-2026-56718 affects AJCloud AJY IPC firmware before 01.10715.11.37. The jdbhttpd service on port 80 accepts path traversal sequences in an unauthenticated request, allowing arbitrary files readable with root privileges to be retrieved. The record lists cleartext RTSP credentials, Wi-Fi SSID and pre-shared key, device serial number, and cloud-binding parameters among the exposed data. The CVSS v4 score is 8.7, with high confidentiality impact.

The record names the AJCloud firmware platform, so applicability should not be inferred from a retail brand or camera appearance alone. Check the firmware version in the management interface or vendor app and confirm whether the device uses the AJCloud platform. If the version is below 01.10715.11.37, use the manufacturer’s official update path. Avoid installing firmware images from unrelated download sites or forcing an image intended for another model.

After updating, reboot the camera and verify that the displayed version is 01.10715.11.37 or later. Rotate the camera administrator and RTSP passwords, then change the Wi-Fi pre-shared key used by the device. Review router port-forwarding rules and UPnP mappings for direct exposure of port 80, and remove unneeded remote access. Placing cameras on a separate IoT network also reduces the reach of a compromised device.

Operational Notes

These disclosures show why release timing and CVE publication timing are not always the same. ash_graphql shipped six coordinated fixes in 1.11.0, Open5GS 2.8.0 was later identified as the fixed boundary for two new records, and AJCloud has a specific firmware version marking the safe side of the range. Asset inventories should therefore include package, image, and firmware versions rather than product names alone.

Use a consistent sequence for change work: identify, back up, test, deploy, and verify. Confirm the affected version and exposed interface, create a recovery point for configuration and data, apply the fixed release in staging, test the product’s critical functions and security boundaries, and only then deploy to production. Record the final version, process health, error rate, and access-log checks so the result can support later update decisions and incident response.