An upsert on the primary key in Ash ignores attribute multitenancy, so one tenant can read, overwrite and take over another tenant's records

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-96581 · Microsoft / collected KEV context

cve-program · CVE-2026-96581

• https://github.com/ash-project/ash/security/advisories/GHSA-vw7c-67pf-gh96
• https://cna.erlef.org/cves/CVE-2026-96581.html
• https://osv.dev/vulnerability/EEF-CVE-2026-96581
• https://github.com/ash-project/ash/commit/2333d01ddf37e5909769a513059b27e3183331c5
• https://github.com/ash-project/ash/commit/c9f0cdb31e7c084def05f3f5be69dd7bb7721754

• An upsert on the primary key in Ash ignores attribute multitenancy, so one tenant can read, overwrite and take over another tenant's records · Newly collected advisory · 26 Oct 2026