CVE-2026-86522

MEDIUMPre-NVD 6.36.3
EchelonGraph scoreLOW confidence

This medium-severity CVE scores 6.3 under a secondary CVSS source (NVD's own analysis pending). EPSS exploit-prediction score not yet available (the EPSS model rescores nightly; freshly-published CVEs typically appear within 48 hours). GitHub Security Advisory data not yet ingested — confidence will rise once GHSA publishes (typical lag: hours to days for open-source ecosystem CVEs; never for infrastructure-only CVEs).

Triggered by: NVD CVSS baseline
Sources: secondary
Trending — 3 sources updated this week
6.3EG
EchelonGraph verdictMonitorLow exploitation likelihood right now — keep watching.
  • Lower severity and no public exploit yet
CISA-KEV: Not listedEPSS PROB: 1%CVSS: 6.3Exploit: None knownExposed: 0

No vendor fix yet — apply a workaround or compensating control (WAF / firewall / segmentation) and watch for a patch.

Improper Output Neutralization for Logs vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to forge application log entries by submitting a password reset identity containing newlines or control characters.

AshAuthentication.Strategy.Password.RequestPasswordReset.run/3 interpolates the identity argument, the email or username taken straight from the reset request, into its Logger.warning/1 heredocs without escaping, truncating or type-restricting it. The resource logged beside it is passed through inspect/1, which would have neutralized the value. A newline in the identity therefore ends the log record, and everything after it is written as a line of its own, so an attacker chooses the severity tag and the content of entries that appear to have come from the application.

This issue affects ash_authentication: from 4.2.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.

CVSS v3
6.3
EG Score
6.3(low)
EG Risk
33(Track)
EG Risk 33/100SSVC: Track

EG Risk is EchelonGraph's 0–100 priority score: it fuses intrinsic severity with real-world exploitation and automatability so you can rank equal-severity CVEs and fix the most dangerous first. Higher = act sooner. Distinct from the 0–10 EG Score (severity).

How it’s computed
Severity63% × 45%
Exploitation0% × 40%
Automatability30% × 15%
Action: Routine — remediate on your standard cadence.
EPSS PROB
1%
EPSS %ILE
43%
KEV
Not listed

Published

September 17, 2026

Last Modified

September 18, 2026

Advisory Details (6)

Auto-updated Sep 17, 2026
Patch available. Sources: github, github_commit.
github_commit Patch Available

commit 57c7cc3236be (team-alembic/ash_authentication)

Patch available: team-alembic/ash_authentication v5.0.0-rc.14 (contains commit 57c7cc3236be)

https://github.com/team-alembic/ash_authentication/commit/57c7cc3236bef0fa9da19cb315414f216488866d
github_commit Patch Available

commit fd19358bf0ee (team-alembic/ash_authentication)

Patch available: team-alembic/ash_authentication v4.15.0 (contains commit fd19358bf0ee)

https://github.com/team-alembic/ash_authentication/commit/fd19358bf0eee53ef13dcf17cc499bd4fb393981
github_commit Patch Available

commit 3954f2779297 (team-alembic/ash_authentication)

Patch available: team-alembic/ash_authentication v4.9.7 (contains commit 3954f2779297)

https://github.com/team-alembic/ash_authentication/commit/3954f277929712755aef57a4a3a821688f121316
generic

OSV - Open Source Vulnerabilities

https://osv.dev/vulnerability/EEF-CVE-2026-86522
generic

CVE-2026-86522

https://cna.erlef.org/cves/CVE-2026-86522.html
github Patch Available

Log forgery via unescaped password-reset identity, forceable on PostgreSQL with a null byte · Advisory · team-alembic/ash_authentication · GitHub

https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-wg7g-r393-vr3g

Weakness Classification(1)

MITRE Common Weakness Enumeration — the root-cause categories this CVE belongs to.

Data Freshness Timeline

(refreshed 4× in last 7d / 4× in last 30d)

Each row is a source pipeline that fetched or updated this CVE on that date, with what changed. For example, "NVD update" means NVD published or revised its analysis for this CVE; "MITRE cvelistV5" means we ingested or refreshed it from the CNA feed. Most recent first.

  1. 2026-09-18 19:28 UTCEPSS rescore
  2. 2026-09-17 14:24 UTCEG score recompute
  3. 2026-09-17 13:20 UTCEG score recompute
  4. 2026-09-17 13:19 UTCMITRE cvelistV5first tracked

Frequently asked(5)

What is CVE-2026-86522?
CVE-2026-86522 is a medium vulnerability published on September 17, 2026. Improper Output Neutralization for Logs vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to forge application log entries by submitting a password reset identity containing newlines or control characters.…
When was CVE-2026-86522 disclosed?
CVE-2026-86522 was first published in the National Vulnerability Database on September 17, 2026, with the most recent update on September 18, 2026. EchelonGraph re-ingests CVE updates from NVD on a 2-hour cycle, so this page reflects the latest published state.
Is CVE-2026-86522 actively exploited?
CVE-2026-86522 is not currently on CISA's Known Exploited Vulnerabilities catalog. FIRST EPSS estimates a 1% probability of exploitation in the next 30 days, which ranks it in the top 56.5% of all scored CVEs.
What is the CVSS score of CVE-2026-86522?
CVE-2026-86522 has a CVSS v3 base score of 6.3 (NVD). The EG score is currently aggregating — additional source signals are being incorporated as they become available..
How do I remediate CVE-2026-86522?
Patch to the fixed version published by the affected vendor. Where vendor advisories exist for CVE-2026-86522, EchelonGraph cross-links them in the Vendor Advisories panel below — those typically contain the canonical remediation steps, fixed version numbers, and any vendor-specific mitigations.

Dependency Blast Radius

Explore the affected products and dependency analysis for CVE-2026-86522

Explore →

Is Your Infrastructure Affected by CVE-2026-86522?

EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.

Start Free Scan →Browse All CVEs