Description
Cleartext Storage of Sensitive Information vulnerability in ash-project ash_paper_trail allows an attacker with read access to the generated version resource to recover sensitive values nested inside embedded resources, unions, or lists.

sensitive_attributes :redact and :ignore only act on the tracked resource's top-level attributes. maybe_redact_changes/3 and the stored-action-input path in AshPaperTrail.Resource.Changes.CreateNewVersion derive the sensitive set from the resource's own attributes and never descend into embedded, union, or list values, so a non-sensitive attribute or action argument that holds an embed with a sensitive? field (for example an accepted credentials embed carrying a token) is written to the version table in cleartext.

This issue affects ash_paper_trail: from 0.3.0 before 0.7.0.
Published: 2026-08-30
Score: 5.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 30 Aug 2026 00:30:00 +0000

Type Values Removed Values Added
Description Cleartext Storage of Sensitive Information vulnerability in ash-project ash_paper_trail allows an attacker with read access to the generated version resource to recover sensitive values nested inside embedded resources, unions, or lists. sensitive_attributes :redact and :ignore only act on the tracked resource's top-level attributes. maybe_redact_changes/3 and the stored-action-input path in AshPaperTrail.Resource.Changes.CreateNewVersion derive the sensitive set from the resource's own attributes and never descend into embedded, union, or list values, so a non-sensitive attribute or action argument that holds an embed with a sensitive? field (for example an accepted credentials embed carrying a token) is written to the version table in cleartext. This issue affects ash_paper_trail: from 0.3.0 before 0.7.0.
Title Sensitive fields nested in embedded values are not redacted in AshPaperTrail versions
First Time appeared Ash-project
Ash-project ash Paper Trail
Weaknesses CWE-312
CPEs cpe:2.3:a:ash-project:ash_paper_trail:*:*:*:*:*:*:*:*
Vendors & Products Ash-project
Ash-project ash Paper Trail
References
Metrics cvssV4_0

{'score': 5.9, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Ash-project Ash Paper Trail
cve-icon MITRE

Status: PUBLISHED

Assigner: EEF

Published:

Updated: 2026-08-30T00:18:22.853Z

Reserved: 2026-08-24T15:45:02.123Z

Link: CVE-2026-77970

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-30T01:20:29.773

Modified: 2026-08-30T01:20:29.773

Link: CVE-2026-77970

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-30T01:30:17Z

Weaknesses
  • CWE-312

    Cleartext Storage of Sensitive Information