All vulnerabilities
CVE-2026-94206

cloak_ecto: Cloak PBKDF2 field ignores the configured iteration count and runs only :size rounds

danielberkompas cloak_ecto
Open in ThreatlineRecord JSON
CVSS
6.3Medium
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 6 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.26%Chance of exploitation activity in the next 30 days, higher than 16% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.0.0-alpha.0Also 681c9702b7cd9afe0e5a840751ab009f550c69a9CVE List
Published6 Oct 2026Updated 6 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Use of Password Hash With Insufficient Computational Effort vulnerability in danielberkompas cloak_ecto and danielberkompas cloak allows an attacker who holds the hashed values and the configured secret to brute-force low-entropy plaintexts much faster than configured.

The dump/1 callback that Cloak.Ecto.PBKDF2 (Cloak.Fields.PBKDF2 in cloak before the Ecto code moved to cloak_ecto) injects into a field module calls :pbkdf2.pbkdf2/4 with config[:size] in the iteration-count position. The :iterations setting is validated but never used. With the cloak_ecto defaults (iterations: 600_000, size: 32) each hash runs 32 PBKDF2 rounds instead of 600,000, so offline guessing of values such as email addresses costs about 18,750 times less than configured.

This issue affects cloak_ecto: from 1.0.0-alpha.0 onward; cloak: from 0.7.0 before 1.0.0-alpha.0.

Text from CVE List

Affected versions 4

  • cloak_ectoaffected: 1.0.0-alpha.0 and laterCVE List
  • cloak_ectoaffected: a8fa1642b02f1c445a1ee8794c9095eb0921f8f3 and laterCVE List
  • cloakaffected: 0.7.0 before 1.0.0-alpha.0CVE List
  • cloakaffected: 8699e6417a162c39d9f0ef63511bd23d3f38d1d2 before 681c9702b7cd9afe0e5a840751ab009f550c69a9CVE List

References 5