Critical Vulnerability in Ash GraphQL Allows Unbounded Database Reads

A high-severity vulnerability (CVE-2026-81636) has been identified in the ash_graphql library of the Ash Project, allowing unauthenticated clients to bypass GraphQL query-complexity limits. This flaw enables attackers to perform unbounded database reads by exploiting the query complexity calculation, particularly with nested relay queries. The affected versions range from 0.16.23 to below 1.11.0. The vulnerability is classified with a CVSS score of 8.7, indicating a high level of risk. A fix has been implemented that adds pagination limits to prevent excessive resource allocation. Users of the affected library are urged to update to the latest version to mitigate the risk. The vulnerability was reported by Peter Ullrich and remediated by Zach Daniel from the Ash Project.

Key Points: • CVE-2026-81636 allows unauthenticated access to bypass GraphQL limits. • Affected versions of ash_graphql range from 0.16.23 to below 1.11.0. • A fix has been released to limit query complexity and prevent exploitation.