Hex/ash_postgres CVE-2026-115635: medium 6, EPSS 0.25%
AshPostgres returns another tenant's record for a skipped upsert when return_skipped_upsert? is set
Action: Upgrade ash_postgres to 2.15.2 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.6.22 | 2.15.2 | - |
Fixed versions
| 2.15.2 |
Sources
- osv: EEF-CVE-2026-115635
- nvd: CVE-2026-115635
- https://github.com/ash-project/ash/security/advisories/GHSA-36hg-wwp2-fg8w
- https://cna.erlef.org/cves/CVE-2026-115635.html
- https://github.com/ash-project/ash_postgres/commit/af0903f1380468bbe1b61fe65acb33772b5e24a5
- https://github.com/ash-project/ash_postgres/commit/8aa81220c401cae412d21078d11b3519ea25d3a9
- https://hex.pm/packages/ash_postgres
CVE-2026-115635 · published · modified · JSON