AIKIDO-2026-117082
ash_cloak is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
21
Low Risk
This Affects:
ash_cloakTL;DR
When a resource declares an encrypted attribute, the encryption transformer removes it from the action's accept list and adds a plain action argument that carries the cleartext value. That argument inherits its sensitivity from the source attribute instead of always being marked sensitive, so cleartext stays unredacted whenever the attribute is not explicitly flagged sensitive. The plaintext can then surface in validation error messages, application logs, changeset inspection, telemetry, and crash dumps. The fix marks the generated plaintext argument as sensitive unconditionally.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you declare encrypted attributes without an explicit sensitive? true flag, so the generated plaintext action argument can surface in errors, logs, or telemetry.
Background info
ash_cloak is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor in versions 0.1.0 - 0.3.1.
How to fix this
Upgrade the ash_cloak library to the patch version.
Links
GitHub Release
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.