CVE-2026-78038

MediumCVSS 5.9

Published: 30/08/2026(UTC)Translated: 30/08/2026(UTC)NVD NIST

Summary

A vulnerability in ash_oban allows a user whose input reaches the :args option of AshOban.build_trigger/3 to retarget an update or destroy trigger at another record, including across tenants. This occurs because caller keys arrive as strings after JSON round-trip, bypassing merge collision handling and allowing override of trusted values.

Risk Assessment

The organization is exposed to authorization bypass and tenant isolation breaks, potentially leading to unauthorized data access or modification.

Recommendation

It is recommended to immediately upgrade ash_oban to version 0.8.14 or later and avoid forwarding user input to the :args option without proper validation.

Other vulnerabilities in ash_oban

CVE-2026-78228Medium
An uncontrolled recursion vulnerability in ash-project ash_oban allows a user who can drive a trigger's on_error action to fail on the final attempt to exhaust worker CPU and memory, denying service. The generated worker's atomic handle_error/4 runs the trigger's on_error action on a job's final attempt inside a rescue that, when the action itself raises, calls handle_error/4 again with the same job, leading to infinite recursion and unbounded heap growth. This issue affects ash_oban from 0.8.0-rc.1 before 0.8.14.

Original NVD description (English source)

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash_oban allows a user whose input reaches the :args option of AshOban.build_trigger/3 to retarget an update or destroy trigger at another record, including across tenants. build_trigger/3 builds the trusted job arguments with atom keys (:primary_key, :tenant, :action_arguments) and merges the caller's :args underneath so the trusted values win on collision. Because Oban job arguments round-trip through JSON, the caller's keys arrive as strings, so Map.merge sees no collision and both keys survive. When the job is persisted the JSON object is de-duplicated keeping the last (string) key, and the worker reads the caller's value. The documentation describes :args as unable to affect the action, so an application that forwards user input into it for uniqueness scoping is exposed to authorization bypass and tenant isolation breaks. This issue affects ash_oban: from 0.2.5 before 0.8.14.