CVE-2026-77970
Sensitive fields nested in embedded values are not redacted in AshPaperTrail versions
Cleartext Storage of Sensitive Information vulnerability in ash-project ash_paper_trail allows an attacker with read access to the generated version resource to recover sensitive values nested inside embedded resources, unions, or lists. sensitive_attributes :redact and :ignore only act on the tracked resource's top-level attributes. maybe_redact_changes/3 and the stored-action-input path in AshPaperTrail.Resource.Changes.CreateNewVersion derive the sensitive set from the resource's own attributes and never descend into embedded, union, or list values, so a non-sensitive attribute or action argument that holds an embed with a sensitive? field (for example an accepted credentials embed carrying a token) is written to the version table in cleartext. This issue affects ash_paper_trail: from 0.3.0 before 0.7.0.
| CWE | CWE-312 |
| Vendor | ash-project |
| Product | ash_paper_trail |
| Published | Aug 30, 2026 |
Get instant alerts for ash-project ash_paper_trail
Be the first to know when new unknown vulnerabilities affecting ash-project ash_paper_trail are published — delivered to Slack, Telegram or Discord.