AshPostgres returns another tenant's record for a skipped upsert when return_skipped_upsert? is set

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-115635 · Microsoft / collected KEV context

cve-program · CVE-2026-115635

• https://github.com/ash-project/ash/security/advisories/GHSA-36hg-wwp2-fg8w
• https://cna.erlef.org/cves/CVE-2026-115635.html
• https://osv.dev/vulnerability/EEF-CVE-2026-115635
• https://github.com/ash-project/ash_postgres/commit/af0903f1380468bbe1b61fe65acb33772b5e24a5
• https://github.com/ash-project/ash_postgres/commit/8aa81220c401cae412d21078d11b3519ea25d3a9

• AshPostgres returns another tenant's record for a skipped upsert when return_skipped_upsert? is set · Newly collected advisory · 25 Oct 2026