EEF-CVE-2026-81633

## Summary

Improper Input Validation vulnerability in ash-project ash\_graphql allows an unauthenticated client to crash a relay node(id: ...) query with an unhandled KeyError.

AshGraphql.Graphql.Resolver.resolve\_node/2 decodes the client-supplied global ID with decode\_relay\_id/1, which only base64-decodes the string and splits it on : without validating the type segment. The decoded type is passed straight to Map.fetch!(type\_to\_domain\_and\_resource\_map, type). Because fetch! raises on a missing key, a relay ID whose type segment is a valid atom that is not a relay-exposed type aborts the resolver before its resolve/2 clauses and their rescue handlers run, so the error never becomes a GraphQL error and may expose a stacktrace. Common resource names are easy to guess. The fix uses Map.fetch/2 and returns an Invalid node id error for unknown types.

This issue affects ash\_graphql: from 0.27.0 before 1.11.0.