Search
Find a vulnerability
Search criteria
170 vulnerabilities by ash-project
CVE-2026-93477 (GCVE-0-2026-93477)
Vulnerability from nvd – Published: 2026-09-25 07:08 – Updated: 2026-09-25 13:26
VLAI
EPSS
VEX
Title
Private action arguments can be set by user input on the bulk destroy and bulk update paths in Ash
Summary
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash allows a user to set the value of a private action argument on the bulk destroy and bulk update paths.
Action arguments declared with public?: false are meant to be set only by trusted server-side code (for example via Ash.Changeset.set_private_argument/3) and must not be settable from end-user input. CVE-2026-55736 fixed the non-bulk changeset path to strip private arguments from user-supplied parameter maps, but the bulk destroy and bulk update paths were not covered.
Ash.Actions.Destroy.Bulk.base_changeset/5 and Ash.Actions.Update.Bulk.base_changeset/5 match every key in the caller-supplied parameter map against all of the action's arguments with no public? check, then apply the matches to the base changeset. A caller who can submit parameters to a bulk destroy or bulk update action (for example through AshJsonApi, AshGraphql, or a controller that forwards request parameters to Ash.bulk_destroy/4 or Ash.bulk_update/4) can therefore set any private argument of that action, including one referenced by an arg(...) template in the action's changes or validations. Depending on how the application uses the argument (for example an acting_user_id driving authorization or record ownership, or audit metadata), this can lead to an integrity violation or privilege escalation.
The fix requires public? in the argument matching on both bulk paths; private arguments remain settable server-side via the :private_arguments option.
This issue affects ash: from 2.17.15 before 3.33.11.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-25 13:26 UTC
CWE
- CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes
Assigner
References
5 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash |
Affected:
2.17.15 , < 3.33.11
(semver)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
|
| ash-project | ash |
Affected:
8c17434803b2e91de522bdfbd0ca918e5d5898df , < 6b7ac53a0a2532291eb940d7beaf0fbb2da6fc4f
(git)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-93477",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-25T13:26:14.200048Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T13:26:42.369Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-c2p4-p7q6-hr2j"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Actions.Destroy.Bulk\u0027",
"\u0027Elixir.Ash.Actions.Update.Bulk\u0027"
],
"packageName": "ash",
"packageURL": "pkg:hex/ash",
"product": "ash",
"programFiles": [
"lib/ash/actions/destroy/bulk.ex",
"lib/ash/actions/update/bulk.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Actions.Destroy.Bulk\u0027:base_changeset/5"
},
{
"name": "\u0027Elixir.Ash.Actions.Update.Bulk\u0027:base_changeset/5"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "3.33.11",
"status": "affected",
"version": "2.17.15",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Actions.Destroy.Bulk\u0027",
"\u0027Elixir.Ash.Actions.Update.Bulk\u0027"
],
"packageName": "ash-project/ash",
"packageURL": "pkg:github/ash-project/ash",
"product": "ash",
"programFiles": [
"lib/ash/actions/destroy/bulk.ex",
"lib/ash/actions/update/bulk.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Actions.Destroy.Bulk\u0027:base_changeset/5"
},
{
"name": "\u0027Elixir.Ash.Actions.Update.Bulk\u0027:base_changeset/5"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "6b7ac53a0a2532291eb940d7beaf0fbb2da6fc4f",
"status": "affected",
"version": "8c17434803b2e91de522bdfbd0ca918e5d5898df",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn action must declare a private argument (\u003ccode\u003epublic?: false\u003c/code\u003e) that is referenced by an \u003ccode\u003earg(...)\u003c/code\u003e template in one of its changes or validations, be invocable as a bulk destroy or bulk update, and the application must pass untrusted user-supplied parameters into \u003ccode\u003eAsh.bulk_destroy/4\u003c/code\u003e or \u003ccode\u003eAsh.bulk_update/4\u003c/code\u003e (directly or through AshJsonApi/AshGraphql).\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "An action must declare a private argument (`public?: false`) that is referenced by an `arg(...)` template in one of its changes or validations, be invocable as a bulk destroy or bulk update, and the application must pass untrusted user-supplied parameters into `Ash.bulk_destroy/4` or `Ash.bulk_update/4` (directly or through AshJsonApi/AshGraphql)."
}
],
"value": "An action must declare a private argument (public?: false) that is referenced by an arg(...) template in one of its changes or validations, be invocable as a bulk destroy or bulk update, and the application must pass untrusted user-supplied parameters into Ash.bulk_destroy/4 or Ash.bulk_update/4 (directly or through AshJsonApi/AshGraphql)."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.33.11",
"versionStartIncluding": "2.17.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "zx"
},
{
"lang": "en",
"type": "reporter",
"value": "zx"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"dateAssigned": "2026-09-25T06:50:10.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash allows a user to set the value of a private action argument on the bulk destroy and bulk update paths.\u003c/p\u003e\n\u003cp\u003eAction arguments declared with \u003ccode\u003epublic?: false\u003c/code\u003e are meant to be set only by trusted server-side code (for example via \u003ccode\u003eAsh.Changeset.set_private_argument/3\u003c/code\u003e) and must not be settable from end-user input. CVE-2026-55736 fixed the non-bulk changeset path to strip private arguments from user-supplied parameter maps, but the bulk destroy and bulk update paths were not covered.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eAsh.Actions.Destroy.Bulk.base_changeset/5\u003c/code\u003e and \u003ccode\u003eAsh.Actions.Update.Bulk.base_changeset/5\u003c/code\u003e match every key in the caller-supplied parameter map against all of the action\u0027s arguments with no \u003ccode\u003epublic?\u003c/code\u003e check, then apply the matches to the base changeset. A caller who can submit parameters to a bulk destroy or bulk update action (for example through AshJsonApi, AshGraphql, or a controller that forwards request parameters to \u003ccode\u003eAsh.bulk_destroy/4\u003c/code\u003e or \u003ccode\u003eAsh.bulk_update/4\u003c/code\u003e) can therefore set any private argument of that action, including one referenced by an \u003ccode\u003earg(...)\u003c/code\u003e template in the action\u0027s changes or validations. Depending on how the application uses the argument (for example an \u003ccode\u003eacting_user_id\u003c/code\u003e driving authorization or record ownership, or audit metadata), this can lead to an integrity violation or privilege escalation.\u003c/p\u003e\n\u003cp\u003eThe fix requires \u003ccode\u003epublic?\u003c/code\u003e in the argument matching on both bulk paths; private arguments remain settable server-side via the \u003ccode\u003e:private_arguments\u003c/code\u003e option.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash: from 2.17.15 before 3.33.11.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash allows a user to set the value of a private action argument on the bulk destroy and bulk update paths.\n\nAction arguments declared with `public?: false` are meant to be set only by trusted server-side code (for example via `Ash.Changeset.set_private_argument/3`) and must not be settable from end-user input. CVE-2026-55736 fixed the non-bulk changeset path to strip private arguments from user-supplied parameter maps, but the bulk destroy and bulk update paths were not covered.\n\n`Ash.Actions.Destroy.Bulk.base_changeset/5` and `Ash.Actions.Update.Bulk.base_changeset/5` match every key in the caller-supplied parameter map against all of the action\u0027s arguments with no `public?` check, then apply the matches to the base changeset. A caller who can submit parameters to a bulk destroy or bulk update action (for example through AshJsonApi, AshGraphql, or a controller that forwards request parameters to `Ash.bulk_destroy/4` or `Ash.bulk_update/4`) can therefore set any private argument of that action, including one referenced by an `arg(...)` template in the action\u0027s changes or validations. Depending on how the application uses the argument (for example an `acting_user_id` driving authorization or record ownership, or audit metadata), this can lead to an integrity violation or privilege escalation.\n\nThe fix requires `public?` in the argument matching on both bulk paths; private arguments remain settable server-side via the `:private_arguments` option.\n\nThis issue affects ash: from 2.17.15 before 3.33.11."
}
],
"value": "Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash allows a user to set the value of a private action argument on the bulk destroy and bulk update paths.\n\nAction arguments declared with public?: false are meant to be set only by trusted server-side code (for example via Ash.Changeset.set_private_argument/3) and must not be settable from end-user input. CVE-2026-55736 fixed the non-bulk changeset path to strip private arguments from user-supplied parameter maps, but the bulk destroy and bulk update paths were not covered.\n\nAsh.Actions.Destroy.Bulk.base_changeset/5 and Ash.Actions.Update.Bulk.base_changeset/5 match every key in the caller-supplied parameter map against all of the action\u0027s arguments with no public? check, then apply the matches to the base changeset. A caller who can submit parameters to a bulk destroy or bulk update action (for example through AshJsonApi, AshGraphql, or a controller that forwards request parameters to Ash.bulk_destroy/4 or Ash.bulk_update/4) can therefore set any private argument of that action, including one referenced by an arg(...) template in the action\u0027s changes or validations. Depending on how the application uses the argument (for example an acting_user_id driving authorization or record ownership, or audit metadata), this can lead to an integrity violation or privilege escalation.\n\nThe fix requires public? in the argument matching on both bulk paths; private arguments remain settable server-side via the :private_arguments option.\n\nThis issue affects ash: from 2.17.15 before 3.33.11."
}
],
"impacts": [
{
"capecId": "CAPEC-77",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-77 Manipulating User-Controlled Variables"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-915",
"description": "CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T07:08:55.191Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "GHSA-c2p4-p7q6-hr2j",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-c2p4-p7q6-hr2j"
},
{
"name": "EEF CNA record for CVE-2026-93477",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-93477.html"
},
{
"name": "OSV record EEF-CVE-2026-93477",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-93477"
},
{
"name": "Introducing commit 8c17434 in ash-project/ash",
"tags": [
"related"
],
"url": "https://github.com/ash-project/ash/commit/8c17434803b2e91de522bdfbd0ca918e5d5898df"
},
{
"name": "Fix commit 6b7ac53 in ash-project/ash",
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash/commit/6b7ac53a0a2532291eb940d7beaf0fbb2da6fc4f"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Private action arguments can be set by user input on the bulk destroy and bulk update paths in Ash"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-93477",
"datePublished": "2026-09-25T07:08:55.191Z",
"dateReserved": "2026-09-19T16:00:02.004Z",
"dateUpdated": "2026-09-25T13:26:42.369Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86338 (GCVE-0-2026-86338)
Vulnerability from nvd – Published: 2026-09-16 08:28 – Updated: 2026-09-16 14:49
VLAI
EPSS
VEX
Title
Ash field policies do not filter-nil forbidden calculations and aggregates, enabling an information-disclosure oracle
Summary
Ash field_policies are documented to protect against filter-based information disclosure: when a field the actor may not see is referenced in a filter, it is replaced with an expression that evaluates to nil, so a filter cannot be used as a yes/no oracle to read a value the actor cannot see.
This nilling was applied to attributes but not to calculations or aggregates. A user-supplied filter reference to a calculation or aggregate carries an Ash.Query.Calculation / Ash.Query.Aggregate struct, which the authorizer's reference replacement did not match (it only matched the Ash.Resource.* structs), so the filter ran against the real value.
As a result, an actor whose field policies forbid a calculation or aggregate can still filter by it (for example filter(secret_calc == "x") or filter(comment_count == n)) and learn the value from whether rows match — an oracle that recovers field-policy-protected values one probe at a time. Filtering is commonly exposed to lower-privileged actors (for example via AshGraphql or AshJsonApi filter arguments), which is exactly the surface field policies are meant to protect.
The fix routes filter references to calculations and aggregates through the same field-policy nilling as attributes.
This issue affects ash: from 2.11.0-rc.0 before 3.33.4.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 14:49 UTC
CWE
- CWE-1220 - Insufficient Granularity of Access Control
Assigner
References
5 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash |
Affected:
2.11.0-rc.0 , < 3.33.4
(semver)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
|
| ash-project | ash |
Affected:
0b6d93c7c4637280b46ae66ea1d2eaf013701238 , < b3d4503241f3deacb5ceb955e10a4fa927da0f67
(git)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86338",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T14:49:09.195379Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T14:49:17.203Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Policy.Authorizer\u0027"
],
"packageName": "ash",
"packageURL": "pkg:hex/ash",
"product": "ash",
"programFiles": [
"lib/ash/policy/authorizer/authorizer.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Policy.Authorizer\u0027:do_replace_ref/2"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "3.33.4",
"status": "affected",
"version": "2.11.0-rc.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Policy.Authorizer\u0027"
],
"packageName": "ash-project/ash",
"packageURL": "pkg:github/ash-project/ash",
"product": "ash",
"programFiles": [
"lib/ash/policy/authorizer/authorizer.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Policy.Authorizer\u0027:do_replace_ref/2"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "b3d4503241f3deacb5ceb955e10a4fa927da0f67",
"status": "affected",
"version": "0b6d93c7c4637280b46ae66ea1d2eaf013701238",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eReachable only when an application uses \u003ccode\u003eAsh.Policy.Authorizer\u003c/code\u003e field policies to restrict a calculation or aggregate, and exposes filtering on it to an actor who is denied that field (for example an authenticated user filtering through AshGraphql or AshJsonApi).\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Reachable only when an application uses `Ash.Policy.Authorizer` field policies to restrict a calculation or aggregate, and exposes filtering on it to an actor who is denied that field (for example an authenticated user filtering through AshGraphql or AshJsonApi)."
}
],
"value": "Reachable only when an application uses Ash.Policy.Authorizer field policies to restrict a calculation or aggregate, and exposes filtering on it to an actor who is denied that field (for example an authenticated user filtering through AshGraphql or AshJsonApi)."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.33.4",
"versionStartIncluding": "2.11.0-rc.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Jesse Williams"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "finder",
"value": "Jesse Williams"
}
],
"dateAssigned": "2026-09-15T23:33:34.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAsh \u003ccode\u003efield_policies\u003c/code\u003e are documented to protect against filter-based information disclosure: when a field the actor may not see is referenced in a filter, it is replaced with an expression that evaluates to \u003ccode\u003enil\u003c/code\u003e, so a filter cannot be used as a yes/no oracle to read a value the actor cannot see.\u003c/p\u003e\n\u003cp\u003eThis nilling was applied to attributes but not to calculations or aggregates. A user-supplied filter reference to a calculation or aggregate carries an \u003ccode\u003eAsh.Query.Calculation\u003c/code\u003e / \u003ccode\u003eAsh.Query.Aggregate\u003c/code\u003e struct, which the authorizer\u0027s reference replacement did not match (it only matched the \u003ccode\u003eAsh.Resource.*\u003c/code\u003e structs), so the filter ran against the real value.\u003c/p\u003e\n\u003cp\u003eAs a result, an actor whose field policies forbid a calculation or aggregate can still filter by it (for example \u003ccode\u003efilter(secret_calc == \"x\")\u003c/code\u003e or \u003ccode\u003efilter(comment_count == n)\u003c/code\u003e) and learn the value from whether rows match \u2014 an oracle that recovers field-policy-protected values one probe at a time. Filtering is commonly exposed to lower-privileged actors (for example via AshGraphql or AshJsonApi filter arguments), which is exactly the surface field policies are meant to protect.\u003c/p\u003e\n\u003cp\u003eThe fix routes filter references to calculations and aggregates through the same field-policy nilling as attributes.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash: from 2.11.0-rc.0 before 3.33.4.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Ash `field_policies` are documented to protect against filter-based information disclosure: when a field the actor may not see is referenced in a filter, it is replaced with an expression that evaluates to `nil`, so a filter cannot be used as a yes/no oracle to read a value the actor cannot see.\n\nThis nilling was applied to attributes but not to calculations or aggregates. A user-supplied filter reference to a calculation or aggregate carries an `Ash.Query.Calculation` / `Ash.Query.Aggregate` struct, which the authorizer\u0027s reference replacement did not match (it only matched the `Ash.Resource.*` structs), so the filter ran against the real value.\n\nAs a result, an actor whose field policies forbid a calculation or aggregate can still filter by it (for example `filter(secret_calc == \"x\")` or `filter(comment_count == n)`) and learn the value from whether rows match \u2014 an oracle that recovers field-policy-protected values one probe at a time. Filtering is commonly exposed to lower-privileged actors (for example via AshGraphql or AshJsonApi filter arguments), which is exactly the surface field policies are meant to protect.\n\nThe fix routes filter references to calculations and aggregates through the same field-policy nilling as attributes.\n\nThis issue affects ash: from 2.11.0-rc.0 before 3.33.4."
}
],
"value": "Ash field_policies are documented to protect against filter-based information disclosure: when a field the actor may not see is referenced in a filter, it is replaced with an expression that evaluates to nil, so a filter cannot be used as a yes/no oracle to read a value the actor cannot see.\n\nThis nilling was applied to attributes but not to calculations or aggregates. A user-supplied filter reference to a calculation or aggregate carries an Ash.Query.Calculation / Ash.Query.Aggregate struct, which the authorizer\u0027s reference replacement did not match (it only matched the Ash.Resource.* structs), so the filter ran against the real value.\n\nAs a result, an actor whose field policies forbid a calculation or aggregate can still filter by it (for example filter(secret_calc == \"x\") or filter(comment_count == n)) and learn the value from whether rows match \u2014 an oracle that recovers field-policy-protected values one probe at a time. Filtering is commonly exposed to lower-privileged actors (for example via AshGraphql or AshJsonApi filter arguments), which is exactly the surface field policies are meant to protect.\n\nThe fix routes filter references to calculations and aggregates through the same field-policy nilling as attributes.\n\nThis issue affects ash: from 2.11.0-rc.0 before 3.33.4."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1220",
"description": "CWE-1220 Insufficient Granularity of Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T08:28:44.114Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "GHSA-7qr8-wrvq-566q",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-7qr8-wrvq-566q"
},
{
"name": "EEF CNA record for CVE-2026-86338",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-86338.html"
},
{
"name": "OSV record EEF-CVE-2026-86338",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-86338"
},
{
"name": "Introducing commit 0b6d93c in ash-project/ash",
"tags": [
"related"
],
"url": "https://github.com/ash-project/ash/commit/0b6d93c7c4637280b46ae66ea1d2eaf013701238"
},
{
"name": "Fix commit b3d4503 in ash-project/ash",
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash/commit/b3d4503241f3deacb5ceb955e10a4fa927da0f67"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Ash field policies do not filter-nil forbidden calculations and aggregates, enabling an information-disclosure oracle"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-86338",
"datePublished": "2026-09-16T08:28:44.114Z",
"dateReserved": "2026-09-15T15:30:01.895Z",
"dateUpdated": "2026-09-16T14:49:17.203Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78230 (GCVE-0-2026-78230)
Vulnerability from nvd – Published: 2026-09-08 16:41 – Updated: 2026-09-08 17:33
VLAI
EPSS
VEX
Title
AshAi aggregate tool can read field-policy-protected fields
Summary
AshAi exposes Ash read actions to language-model tool calls. The read tool accepts an aggregate result type (min, max, sum, avg) that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value.
Ash field policies redact forbidden fields on returned records (replacing them with %Ash.ForbiddenField{}), but that redaction does not apply to aggregate values. A tool caller could therefore read a field the calling actor's field policies forbid by requesting it as an aggregate; min/max in particular return an actual field value. This includes fields that are public? true but restricted per-actor by a field policy, such as sensitive PII. The tool's existing check only required the field to be public, which is a separate axis from per-actor field-policy authorization.
The fix authorizes the aggregated field against the resource's field policies, so aggregating over a field the actor may not see is refused or scoped to the rows where it is visible.
This issue affects ash_ai: from 0.1.0 before 1.0.3.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 17:33 UTC
CWE
- CWE-1220 - Insufficient Granularity of Access Control
Assigner
References
5 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_ai |
Affected:
0.1.0 , < 1.0.3
(semver)
cpe:2.3:a:ash-project:ash_ai:*:*:*:*:*:*:*:* |
|
| ash-project | ash_ai |
Affected:
2ba234b50946a3b8116190c8467f9f4dfa5edce7 , < 9c02de581625c342c9870a672830bff28c1d701e
(git)
cpe:2.3:a:ash-project:ash_ai:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-78230",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T17:33:49.017554Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T17:33:57.604Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_ai:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAi.Tool.Execution\u0027"
],
"packageName": "ash_ai",
"packageURL": "pkg:hex/ash_ai",
"product": "ash_ai",
"programFiles": [
"lib/ash_ai/tool/execution.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAi.Tool.Execution\u0027:execute_read/4"
}
],
"repo": "https://github.com/ash-project/ash_ai",
"vendor": "ash-project",
"versions": [
{
"lessThan": "1.0.3",
"status": "affected",
"version": "0.1.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_ai:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAi.Tool.Execution\u0027"
],
"packageName": "ash-project/ash_ai",
"packageURL": "pkg:github/ash-project/ash_ai",
"product": "ash_ai",
"programFiles": [
"lib/ash_ai/tool/execution.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAi.Tool.Execution\u0027:execute_read/4"
}
],
"repo": "https://github.com/ash-project/ash_ai",
"vendor": "ash-project",
"versions": [
{
"lessThan": "9c02de581625c342c9870a672830bff28c1d701e",
"status": "affected",
"version": "2ba234b50946a3b8116190c8467f9f4dfa5edce7",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eReachable only when an application exposes an AshAi read tool over a resource whose field policies restrict a field that the calling actor can still name as an aggregate (for example a \u003ccode\u003epublic? true\u003c/code\u003e but field-policy-protected attribute).\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Reachable only when an application exposes an AshAi read tool over a resource whose field policies restrict a field that the calling actor can still name as an aggregate (for example a `public? true` but field-policy-protected attribute)."
}
],
"value": "Reachable only when an application exposes an AshAi read tool over a resource whose field policies restrict a field that the calling actor can still name as an aggregate (for example a public? true but field-policy-protected attribute)."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_ai:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.0.3",
"versionStartIncluding": "0.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "finder",
"value": "Aaron Hong / Remedy"
}
],
"dateAssigned": "2026-09-08T15:44:25.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAshAi exposes Ash read actions to language-model tool calls. The read tool accepts an aggregate result type (\u003ccode\u003emin\u003c/code\u003e, \u003ccode\u003emax\u003c/code\u003e, \u003ccode\u003esum\u003c/code\u003e, \u003ccode\u003eavg\u003c/code\u003e) that builds an ad-hoc \u003ccode\u003eAsh.Query.Aggregate\u003c/code\u003e over a named field and returns its raw value.\u003c/p\u003e\n\u003cp\u003eAsh field policies redact forbidden fields on returned records (replacing them with \u003ccode\u003e%Ash.ForbiddenField{}\u003c/code\u003e), but that redaction does not apply to aggregate values. A tool caller could therefore read a field the calling actor\u0027s field policies forbid by requesting it as an aggregate; \u003ccode\u003emin\u003c/code\u003e/\u003ccode\u003emax\u003c/code\u003e in particular return an actual field value. This includes fields that are \u003ccode\u003epublic? true\u003c/code\u003e but restricted per-actor by a field policy, such as sensitive PII. The tool\u0027s existing check only required the field to be public, which is a separate axis from per-actor field-policy authorization.\u003c/p\u003e\n\u003cp\u003eThe fix authorizes the aggregated field against the resource\u0027s field policies, so aggregating over a field the actor may not see is refused or scoped to the rows where it is visible.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_ai: from 0.1.0 before 1.0.3.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "AshAi exposes Ash read actions to language-model tool calls. The read tool accepts an aggregate result type (`min`, `max`, `sum`, `avg`) that builds an ad-hoc `Ash.Query.Aggregate` over a named field and returns its raw value.\n\nAsh field policies redact forbidden fields on returned records (replacing them with `%Ash.ForbiddenField{}`), but that redaction does not apply to aggregate values. A tool caller could therefore read a field the calling actor\u0027s field policies forbid by requesting it as an aggregate; `min`/`max` in particular return an actual field value. This includes fields that are `public? true` but restricted per-actor by a field policy, such as sensitive PII. The tool\u0027s existing check only required the field to be public, which is a separate axis from per-actor field-policy authorization.\n\nThe fix authorizes the aggregated field against the resource\u0027s field policies, so aggregating over a field the actor may not see is refused or scoped to the rows where it is visible.\n\nThis issue affects ash_ai: from 0.1.0 before 1.0.3."
}
],
"value": "AshAi exposes Ash read actions to language-model tool calls. The read tool accepts an aggregate result type (min, max, sum, avg) that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value.\n\nAsh field policies redact forbidden fields on returned records (replacing them with %Ash.ForbiddenField{}), but that redaction does not apply to aggregate values. A tool caller could therefore read a field the calling actor\u0027s field policies forbid by requesting it as an aggregate; min/max in particular return an actual field value. This includes fields that are public? true but restricted per-actor by a field policy, such as sensitive PII. The tool\u0027s existing check only required the field to be public, which is a separate axis from per-actor field-policy authorization.\n\nThe fix authorizes the aggregated field against the resource\u0027s field policies, so aggregating over a field the actor may not see is refused or scoped to the rows where it is visible.\n\nThis issue affects ash_ai: from 0.1.0 before 1.0.3."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1220",
"description": "CWE-1220 Insufficient Granularity of Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T16:41:45.975Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "GHSA-v5rw-36x5-r5vx",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/ash-project/ash_ai/security/advisories/GHSA-v5rw-36x5-r5vx"
},
{
"name": "EEF CNA record for CVE-2026-78230",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-78230.html"
},
{
"name": "OSV record EEF-CVE-2026-78230",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-78230"
},
{
"name": "Introducing commit 2ba234b in ash-project/ash_ai",
"tags": [
"related"
],
"url": "https://github.com/ash-project/ash_ai/commit/2ba234b50946a3b8116190c8467f9f4dfa5edce7"
},
{
"name": "Fix commit 9c02de5 in ash-project/ash_ai",
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_ai/commit/9c02de581625c342c9870a672830bff28c1d701e"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "AshAi aggregate tool can read field-policy-protected fields"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-78230",
"datePublished": "2026-09-08T16:41:45.975Z",
"dateReserved": "2026-08-31T00:45:02.439Z",
"dateUpdated": "2026-09-08T17:33:57.604Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78216 (GCVE-0-2026-78216)
Vulnerability from nvd – Published: 2026-09-08 16:42 – Updated: 2026-09-08 17:27
VLAI
EPSS
VEX
Title
AshLua eval read operations can read field-policy-protected fields via aggregates
Summary
AshLua exposes Ash read actions to Lua scripts run through an eval action. A read call accepts an operation (list, min, max, first, sum, avg) that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value.
Ash field policies redact forbidden fields on returned records (replacing them with %Ash.ForbiddenField{}), but that redaction does not apply to aggregate values. A script could therefore read a field the calling actor's field policies forbid by requesting it as an aggregate instead of as a field. This includes fields that are public? true but restricted per-actor by a field policy, such as sensitive PII. The prior hardening only enforced the exposed-field allow-list (field visibility), which is a separate axis from per-actor field-policy authorization.
The fix authorizes the aggregated field against the resource's field policies, so aggregating over a field the actor may not see is refused or scoped to the rows where it is visible.
This issue affects ash_lua: from 0.1.0 before 0.2.2.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 17:26 UTC
CWE
- CWE-1220 - Insufficient Granularity of Access Control
Assigner
References
5 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_lua |
Affected:
0.1.0 , < 0.2.2
(semver)
cpe:2.3:a:ash-project:ash_lua:*:*:*:*:*:*:*:* |
|
| ash-project | ash_lua |
Affected:
8675e47cca81f36594083a7e63379bac9e123e72 , < 266a5dcc56d5015b6d316c10606169e753b07450
(git)
cpe:2.3:a:ash-project:ash_lua:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-78216",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T17:26:34.675766Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T17:27:08.856Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_lua:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshLua.Runtime\u0027"
],
"packageName": "ash_lua",
"packageURL": "pkg:hex/ash_lua",
"product": "ash_lua",
"programFiles": [
"lib/ash_lua/runtime.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshLua.Runtime\u0027:run_read_operation/5"
}
],
"repo": "https://github.com/ash-project/ash_lua",
"vendor": "ash-project",
"versions": [
{
"lessThan": "0.2.2",
"status": "affected",
"version": "0.1.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_lua:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshLua.Runtime\u0027"
],
"packageName": "ash-project/ash_lua",
"packageURL": "pkg:github/ash-project/ash_lua",
"product": "ash_lua",
"programFiles": [
"lib/ash_lua/runtime.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshLua.Runtime\u0027:run_read_operation/5"
}
],
"repo": "https://github.com/ash-project/ash_lua",
"vendor": "ash-project",
"versions": [
{
"lessThan": "266a5dcc56d5015b6d316c10606169e753b07450",
"status": "affected",
"version": "8675e47cca81f36594083a7e63379bac9e123e72",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eReachable only when an application exposes an AshLua \u003ccode\u003eeval\u003c/code\u003e action over a resource whose field policies restrict a field that the calling actor can still name as an operation aggregate (for example a \u003ccode\u003epublic? true\u003c/code\u003e but field-policy-protected attribute).\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Reachable only when an application exposes an AshLua `eval` action over a resource whose field policies restrict a field that the calling actor can still name as an operation aggregate (for example a `public? true` but field-policy-protected attribute)."
}
],
"value": "Reachable only when an application exposes an AshLua eval action over a resource whose field policies restrict a field that the calling actor can still name as an operation aggregate (for example a public? true but field-policy-protected attribute)."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_lua:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.2.2",
"versionStartIncluding": "0.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "finder",
"value": "Aaron Hong / Remedy"
}
],
"dateAssigned": "2026-09-08T15:43:48.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAshLua exposes Ash read actions to Lua scripts run through an \u003ccode\u003eeval\u003c/code\u003e action. A read call accepts an \u003ccode\u003eoperation\u003c/code\u003e (\u003ccode\u003elist\u003c/code\u003e, \u003ccode\u003emin\u003c/code\u003e, \u003ccode\u003emax\u003c/code\u003e, \u003ccode\u003efirst\u003c/code\u003e, \u003ccode\u003esum\u003c/code\u003e, \u003ccode\u003eavg\u003c/code\u003e) that builds an ad-hoc \u003ccode\u003eAsh.Query.Aggregate\u003c/code\u003e over a named field and returns its raw value.\u003c/p\u003e\n\u003cp\u003eAsh field policies redact forbidden fields on returned records (replacing them with \u003ccode\u003e%Ash.ForbiddenField{}\u003c/code\u003e), but that redaction does not apply to aggregate values. A script could therefore read a field the calling actor\u0027s field policies forbid by requesting it as an aggregate instead of as a field. This includes fields that are \u003ccode\u003epublic? true\u003c/code\u003e but restricted per-actor by a field policy, such as sensitive PII. The prior hardening only enforced the exposed-field allow-list (field visibility), which is a separate axis from per-actor field-policy authorization.\u003c/p\u003e\n\u003cp\u003eThe fix authorizes the aggregated field against the resource\u0027s field policies, so aggregating over a field the actor may not see is refused or scoped to the rows where it is visible.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_lua: from 0.1.0 before 0.2.2.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "AshLua exposes Ash read actions to Lua scripts run through an `eval` action. A read call accepts an `operation` (`list`, `min`, `max`, `first`, `sum`, `avg`) that builds an ad-hoc `Ash.Query.Aggregate` over a named field and returns its raw value.\n\nAsh field policies redact forbidden fields on returned records (replacing them with `%Ash.ForbiddenField{}`), but that redaction does not apply to aggregate values. A script could therefore read a field the calling actor\u0027s field policies forbid by requesting it as an aggregate instead of as a field. This includes fields that are `public? true` but restricted per-actor by a field policy, such as sensitive PII. The prior hardening only enforced the exposed-field allow-list (field visibility), which is a separate axis from per-actor field-policy authorization.\n\nThe fix authorizes the aggregated field against the resource\u0027s field policies, so aggregating over a field the actor may not see is refused or scoped to the rows where it is visible.\n\nThis issue affects ash_lua: from 0.1.0 before 0.2.2."
}
],
"value": "AshLua exposes Ash read actions to Lua scripts run through an eval action. A read call accepts an operation (list, min, max, first, sum, avg) that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value.\n\nAsh field policies redact forbidden fields on returned records (replacing them with %Ash.ForbiddenField{}), but that redaction does not apply to aggregate values. A script could therefore read a field the calling actor\u0027s field policies forbid by requesting it as an aggregate instead of as a field. This includes fields that are public? true but restricted per-actor by a field policy, such as sensitive PII. The prior hardening only enforced the exposed-field allow-list (field visibility), which is a separate axis from per-actor field-policy authorization.\n\nThe fix authorizes the aggregated field against the resource\u0027s field policies, so aggregating over a field the actor may not see is refused or scoped to the rows where it is visible.\n\nThis issue affects ash_lua: from 0.1.0 before 0.2.2."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1220",
"description": "CWE-1220 Insufficient Granularity of Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T16:42:20.908Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "GHSA-5whv-8rcp-x33j",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/ash-project/ash_lua/security/advisories/GHSA-5whv-8rcp-x33j"
},
{
"name": "EEF CNA record for CVE-2026-78216",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-78216.html"
},
{
"name": "OSV record EEF-CVE-2026-78216",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-78216"
},
{
"name": "Introducing commit 8675e47 in ash-project/ash_lua",
"tags": [
"related"
],
"url": "https://github.com/ash-project/ash_lua/commit/8675e47cca81f36594083a7e63379bac9e123e72"
},
{
"name": "Fix commit 266a5dc in ash-project/ash_lua",
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_lua/commit/266a5dcc56d5015b6d316c10606169e753b07450"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "AshLua eval read operations can read field-policy-protected fields via aggregates"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-78216",
"datePublished": "2026-09-08T16:42:20.908Z",
"dateReserved": "2026-08-31T00:45:02.446Z",
"dateUpdated": "2026-09-08T17:27:08.856Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82710 (GCVE-0-2026-82710)
Vulnerability from nvd – Published: 2026-09-08 00:23 – Updated: 2026-09-08 14:45
VLAI
EPSS
VEX
Title
Terminal escape sequence injection in mix usage_rules.search_docs via package documentation metadata
Summary
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project usage_rules allows a malicious package publisher to inject terminal control sequences into the output of mix usage_rules.search_docs.
mix usage_rules.search_docs searches Hex documentation through search.hexdocs.pm, which indexes the documentation of every published package, and prints the matching results (title, package, type, doc reference, and highlighted snippets) to the terminal. The formatter in Mix.Tasks.UsageRules.SearchDocs interpolated those publisher-controlled fields verbatim, neutralizing no terminal control characters; the only transform it applied adds escape sequences rather than removing them. A malicious package can embed ANSI terminal escape sequences (cursor movement, line erase, carriage returns, OSC 52 clipboard writes) in its indexed documentation, so when a developer runs a search that surfaces those docs the sequences reach the terminal unchanged — forging the displayed hexdocs URL or a suggested command, hiding text, or writing to the clipboard. No authentication or privileged position is required; only publishing a package.
This issue affects usage_rules: from 0.1.18 before 1.2.8.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 14:45 UTC
CWE
- CWE-150 - Improper Neutralization of Escape, Meta, or Control Sequences
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/usage_rules/securi… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82710.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82710 | related |
| https://github.com/ash-project/usage_rules/commit… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | usage_rules |
Affected:
0.1.18 , < 1.2.8
(semver)
cpe:2.3:a:ash-project:usage_rules:*:*:*:*:*:*:*:* |
|
| ash-project | usage_rules |
Affected:
2da7a99536041d63ec1f391d019565789a59595f , < 3b8ebb4117d3272bbd436e6c2432113ba6685dbb
(git)
cpe:2.3:a:ash-project:usage_rules:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82710",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T14:45:15.853850Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T14:45:23.177Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:usage_rules:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Mix.Tasks.UsageRules.SearchDocs\u0027"
],
"packageName": "usage_rules",
"packageURL": "pkg:hex/usage_rules",
"product": "usage_rules",
"programFiles": [
"lib/mix/tasks/usage_rules.search_docs.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Mix.Tasks.UsageRules.SearchDocs\u0027:format_search_result_markdown/4"
}
],
"repo": "https://github.com/ash-project/usage_rules",
"vendor": "ash-project",
"versions": [
{
"lessThan": "1.2.8",
"status": "affected",
"version": "0.1.18",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:usage_rules:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Mix.Tasks.UsageRules.SearchDocs\u0027"
],
"packageName": "ash-project/usage_rules",
"packageURL": "pkg:github/ash-project/usage_rules",
"product": "usage_rules",
"programFiles": [
"lib/mix/tasks/usage_rules.search_docs.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Mix.Tasks.UsageRules.SearchDocs\u0027:format_search_result_markdown/4"
}
],
"repo": "https://github.com/ash-project/usage_rules",
"vendor": "ash-project",
"versions": [
{
"lessThan": "3b8ebb4117d3272bbd436e6c2432113ba6685dbb",
"status": "affected",
"version": "2da7a99536041d63ec1f391d019565789a59595f",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eReachable only when a developer runs \u003ccode\u003emix usage_rules.search_docs\u003c/code\u003e in a terminal emulator that interprets ANSI escape sequences and the results include documentation from an attacker-published package (for example a broad \u003ccode\u003e--everywhere\u003c/code\u003e search).\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Reachable only when a developer runs `mix usage_rules.search_docs` in a terminal emulator that interprets ANSI escape sequences and the results include documentation from an attacker-published package (for example a broad `--everywhere` search)."
}
],
"value": "Reachable only when a developer runs mix usage_rules.search_docs in a terminal emulator that interprets ANSI escape sequences and the results include documentation from an attacker-published package (for example a broad --everywhere search)."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:usage_rules:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.2.8",
"versionStartIncluding": "0.1.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project usage_rules allows a malicious package publisher to inject terminal control sequences into the output of \u003ccode\u003emix usage_rules.search_docs\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003emix usage_rules.search_docs\u003c/code\u003e searches Hex documentation through \u003ccode\u003esearch.hexdocs.pm\u003c/code\u003e, which indexes the documentation of every published package, and prints the matching results (title, package, type, doc reference, and highlighted snippets) to the terminal. The formatter in \u003ccode\u003eMix.Tasks.UsageRules.SearchDocs\u003c/code\u003e interpolated those publisher-controlled fields verbatim, neutralizing no terminal control characters; the only transform it applied adds escape sequences rather than removing them. A malicious package can embed ANSI terminal escape sequences (cursor movement, line erase, carriage returns, OSC 52 clipboard writes) in its indexed documentation, so when a developer runs a search that surfaces those docs the sequences reach the terminal unchanged \u2014 forging the displayed hexdocs URL or a suggested command, hiding text, or writing to the clipboard. No authentication or privileged position is required; only publishing a package.\u003c/p\u003e\n\u003cp\u003eThis issue affects usage_rules: from 0.1.18 before 1.2.8.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project usage_rules allows a malicious package publisher to inject terminal control sequences into the output of `mix usage_rules.search_docs`.\n\n`mix usage_rules.search_docs` searches Hex documentation through `search.hexdocs.pm`, which indexes the documentation of every published package, and prints the matching results (title, package, type, doc reference, and highlighted snippets) to the terminal. The formatter in `Mix.Tasks.UsageRules.SearchDocs` interpolated those publisher-controlled fields verbatim, neutralizing no terminal control characters; the only transform it applied adds escape sequences rather than removing them. A malicious package can embed ANSI terminal escape sequences (cursor movement, line erase, carriage returns, OSC 52 clipboard writes) in its indexed documentation, so when a developer runs a search that surfaces those docs the sequences reach the terminal unchanged \u2014 forging the displayed hexdocs URL or a suggested command, hiding text, or writing to the clipboard. No authentication or privileged position is required; only publishing a package.\n\nThis issue affects usage_rules: from 0.1.18 before 1.2.8."
}
],
"value": "Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project usage_rules allows a malicious package publisher to inject terminal control sequences into the output of mix usage_rules.search_docs.\n\nmix usage_rules.search_docs searches Hex documentation through search.hexdocs.pm, which indexes the documentation of every published package, and prints the matching results (title, package, type, doc reference, and highlighted snippets) to the terminal. The formatter in Mix.Tasks.UsageRules.SearchDocs interpolated those publisher-controlled fields verbatim, neutralizing no terminal control characters; the only transform it applied adds escape sequences rather than removing them. A malicious package can embed ANSI terminal escape sequences (cursor movement, line erase, carriage returns, OSC 52 clipboard writes) in its indexed documentation, so when a developer runs a search that surfaces those docs the sequences reach the terminal unchanged \u2014 forging the displayed hexdocs URL or a suggested command, hiding text, or writing to the clipboard. No authentication or privileged position is required; only publishing a package.\n\nThis issue affects usage_rules: from 0.1.18 before 1.2.8."
}
],
"impacts": [
{
"capecId": "CAPEC-93",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-93 Log Injection-Tampering-Forging"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-150",
"description": "CWE-150 Improper Neutralization of Escape, Meta, or Control Sequences",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T00:23:36.912Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/usage_rules/security/advisories/GHSA-j59f-776f-23hp"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82710.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82710"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/usage_rules/commit/3b8ebb4117d3272bbd436e6c2432113ba6685dbb"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Terminal escape sequence injection in mix usage_rules.search_docs via package documentation metadata"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82710",
"datePublished": "2026-09-08T00:23:36.912Z",
"dateReserved": "2026-09-07T20:30:01.990Z",
"dateUpdated": "2026-09-08T14:45:23.177Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82758 (GCVE-0-2026-82758)
Vulnerability from nvd – Published: 2026-09-07 22:32 – Updated: 2026-09-08 14:41
VLAI
EPSS
VEX
Title
ash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gated Dynamic Client Registration endpoint
Summary
Improper Authentication vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token.
resolve_secret/3 in AshAuthentication.Oauth2Server (reached through __resolve_secret__!) treated any return other than {:ok, _} or :error from a configured {module, function, args} or 2-arity-function secret provider as a valid secret, wrapping nil, false, or "" as {:ok, value}. When the initial_access_token resolves to such an empty value, POST /oauth/register compares the presented bearer token against it and the comparison passes with no token supplied, so registration is open although it was configured closed. The same fail-open affected other resolved secrets such as signing_secret.
This issue affects ash_authentication_oauth2_server: from 0.1.0 before 0.3.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 14:40 UTC
CWE
- CWE-287 - Improper Authentication
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash_authentication… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82758.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82758 | related |
| https://github.com/ash-project/ash_authentication… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_authentication_oauth2_server |
Affected:
0.1.0 , < 0.3.1
(semver)
cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:* |
|
| ash-project | ash_authentication_oauth2_server |
Affected:
855b578037c5ded18e8a6e60f42e56bde4905fae , < 30a87101871775d27d79f9ad6f29eafa4779e118
(git)
cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82758",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T14:40:53.437993Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T14:41:06.227Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAuthentication.Oauth2Server\u0027"
],
"packageName": "ash_authentication_oauth2_server",
"packageURL": "pkg:hex/ash_authentication_oauth2_server",
"product": "ash_authentication_oauth2_server",
"programFiles": [
"lib/ash_authentication/oauth2_server.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAuthentication.Oauth2Server\u0027:__resolve_secret__!/3"
}
],
"repo": "https://github.com/ash-project/ash_authentication_oauth2_server",
"vendor": "ash-project",
"versions": [
{
"lessThan": "0.3.1",
"status": "affected",
"version": "0.1.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAuthentication.Oauth2Server\u0027"
],
"packageName": "ash-project/ash_authentication_oauth2_server",
"packageURL": "pkg:github/ash-project/ash_authentication_oauth2_server",
"product": "ash_authentication_oauth2_server",
"programFiles": [
"lib/ash_authentication/oauth2_server.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAuthentication.Oauth2Server\u0027:__resolve_secret__!/3"
}
],
"repo": "https://github.com/ash-project/ash_authentication_oauth2_server",
"vendor": "ash-project",
"versions": [
{
"lessThan": "30a87101871775d27d79f9ad6f29eafa4779e118",
"status": "affected",
"version": "855b578037c5ded18e8a6e60f42e56bde4905fae",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eReachable only when the server configures an \u003ccode\u003einitial_access_token\u003c/code\u003e (so Dynamic Client Registration is meant to require one) and the configured secret provider returns an empty value (\u003ccode\u003enil\u003c/code\u003e, \u003ccode\u003efalse\u003c/code\u003e, or \u003ccode\u003e\"\"\u003c/code\u003e) or an \u003ccode\u003e{:error, _}\u003c/code\u003e for it, rather than a non-empty binary.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Reachable only when the server configures an `initial_access_token` (so Dynamic Client Registration is meant to require one) and the configured secret provider returns an empty value (`nil`, `false`, or `\"\"`) or an `{:error, _}` for it, rather than a non-empty binary."
}
],
"value": "Reachable only when the server configures an initial_access_token (so Dynamic Client Registration is meant to require one) and the configured secret provider returns an empty value (nil, false, or \"\") or an {:error, _} for it, rather than a non-empty binary."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.3.1",
"versionStartIncluding": "0.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Authentication vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eresolve_secret/3\u003c/code\u003e in \u003ccode\u003eAshAuthentication.Oauth2Server\u003c/code\u003e (reached through \u003ccode\u003e__resolve_secret__!\u003c/code\u003e) treated any return other than \u003ccode\u003e{:ok, _}\u003c/code\u003e or \u003ccode\u003e:error\u003c/code\u003e from a configured \u003ccode\u003e{module, function, args}\u003c/code\u003e or 2-arity-function secret provider as a valid secret, wrapping \u003ccode\u003enil\u003c/code\u003e, \u003ccode\u003efalse\u003c/code\u003e, or \u003ccode\u003e\"\"\u003c/code\u003e as \u003ccode\u003e{:ok, value}\u003c/code\u003e. When the \u003ccode\u003einitial_access_token\u003c/code\u003e resolves to such an empty value, \u003ccode\u003ePOST /oauth/register\u003c/code\u003e compares the presented bearer token against it and the comparison passes with no token supplied, so registration is open although it was configured closed. The same fail-open affected other resolved secrets such as \u003ccode\u003esigning_secret\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_authentication_oauth2_server: from 0.1.0 before 0.3.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Improper Authentication vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token.\n\n`resolve_secret/3` in `AshAuthentication.Oauth2Server` (reached through `__resolve_secret__!`) treated any return other than `{:ok, _}` or `:error` from a configured `{module, function, args}` or 2-arity-function secret provider as a valid secret, wrapping `nil`, `false`, or `\"\"` as `{:ok, value}`. When the `initial_access_token` resolves to such an empty value, `POST /oauth/register` compares the presented bearer token against it and the comparison passes with no token supplied, so registration is open although it was configured closed. The same fail-open affected other resolved secrets such as `signing_secret`.\n\nThis issue affects ash_authentication_oauth2_server: from 0.1.0 before 0.3.1."
}
],
"value": "Improper Authentication vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token.\n\nresolve_secret/3 in AshAuthentication.Oauth2Server (reached through __resolve_secret__!) treated any return other than {:ok, _} or :error from a configured {module, function, args} or 2-arity-function secret provider as a valid secret, wrapping nil, false, or \"\" as {:ok, value}. When the initial_access_token resolves to such an empty value, POST /oauth/register compares the presented bearer token against it and the comparison passes with no token supplied, so registration is open although it was configured closed. The same fail-open affected other resolved secrets such as signing_secret.\n\nThis issue affects ash_authentication_oauth2_server: from 0.1.0 before 0.3.1."
}
],
"impacts": [
{
"capecId": "CAPEC-115",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-115 Authentication Bypass"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287 Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T22:32:17.027Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash_authentication_oauth2_server/security/advisories/GHSA-fxc6-vp68-87pw"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82758.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82758"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_authentication_oauth2_server/commit/30a87101871775d27d79f9ad6f29eafa4779e118"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "ash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gated Dynamic Client Registration endpoint"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82758",
"datePublished": "2026-09-07T22:32:17.027Z",
"dateReserved": "2026-08-31T01:00:10.817Z",
"dateUpdated": "2026-09-08T14:41:06.227Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82757 (GCVE-0-2026-82757)
Vulnerability from nvd – Published: 2026-09-07 22:31 – Updated: 2026-09-08 14:43
VLAI
EPSS
VEX
Title
ash_authentication_oauth2_server CIMD fetcher classifies IPv4-in-IPv6 and site-local addresses as public, allowing SSRF
Summary
Server-Side Request Forgery (SSRF) vulnerability in ash-project ash_authentication_oauth2_server allows an attacker who controls a client metadata URL and its DNS to make the server connect to internal or loopback addresses.
public_ip?/1 in AshAuthentication.Oauth2Server.CIMD.ReqFetcher enforces the outbound policy for CIMD metadata fetches. It classified several address forms as publicly routable that are not: IPv4-compatible ::/96 (for example ::127.0.0.1), SIIT IPv4-translated ::ffff:0:0:0/96, and deprecated site-local fec0::/10. A returned AAAA record in one of these ranges passed the policy, so a fetch pinned to that address reached space the policy was meant to block.
This issue affects ash_authentication_oauth2_server: from 0.3.0 before 0.3.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 14:43 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash_authentication… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82757.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82757 | related |
| https://github.com/ash-project/ash_authentication… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_authentication_oauth2_server |
Affected:
0.3.0 , < 0.3.1
(semver)
cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:* |
|
| ash-project | ash_authentication_oauth2_server |
Affected:
e713a9ba816761140c226e2ca55b75c0b93f5984 , < 268b591261a3473ab9b87272963e4dd2fd99d972
(git)
cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82757",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T14:43:50.818031Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T14:43:57.511Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAuthentication.Oauth2Server.CIMD.ReqFetcher\u0027"
],
"packageName": "ash_authentication_oauth2_server",
"packageURL": "pkg:hex/ash_authentication_oauth2_server",
"product": "ash_authentication_oauth2_server",
"programFiles": [
"lib/ash_authentication/oauth2_server/cimd/req_fetcher.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAuthentication.Oauth2Server.CIMD.ReqFetcher\u0027:public_ip?/1"
},
{
"name": "\u0027Elixir.AshAuthentication.Oauth2Server.CIMD.ReqFetcher\u0027:fetch/2"
}
],
"repo": "https://github.com/ash-project/ash_authentication_oauth2_server",
"vendor": "ash-project",
"versions": [
{
"lessThan": "0.3.1",
"status": "affected",
"version": "0.3.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAuthentication.Oauth2Server.CIMD.ReqFetcher\u0027"
],
"packageName": "ash-project/ash_authentication_oauth2_server",
"packageURL": "pkg:github/ash-project/ash_authentication_oauth2_server",
"product": "ash_authentication_oauth2_server",
"programFiles": [
"lib/ash_authentication/oauth2_server/cimd/req_fetcher.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAuthentication.Oauth2Server.CIMD.ReqFetcher\u0027:public_ip?/1"
},
{
"name": "\u0027Elixir.AshAuthentication.Oauth2Server.CIMD.ReqFetcher\u0027:fetch/2"
}
],
"repo": "https://github.com/ash-project/ash_authentication_oauth2_server",
"vendor": "ash-project",
"versions": [
{
"lessThan": "268b591261a3473ab9b87272963e4dd2fd99d972",
"status": "affected",
"version": "e713a9ba816761140c226e2ca55b75c0b93f5984",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eReachable only when Client ID Metadata Documents are enabled (\u003ccode\u003ecimd_enabled?: true\u003c/code\u003e), so the authorize endpoint fetches attacker-suppliable metadata URLs, and an internal or loopback target resolves to one of the affected IPv6 address forms.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Reachable only when Client ID Metadata Documents are enabled (`cimd_enabled?: true`), so the authorize endpoint fetches attacker-suppliable metadata URLs, and an internal or loopback target resolves to one of the affected IPv6 address forms."
}
],
"value": "Reachable only when Client ID Metadata Documents are enabled (cimd_enabled?: true), so the authorize endpoint fetches attacker-suppliable metadata URLs, and an internal or loopback target resolves to one of the affected IPv6 address forms."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.3.1",
"versionStartIncluding": "0.3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eServer-Side Request Forgery (SSRF) vulnerability in ash-project ash_authentication_oauth2_server allows an attacker who controls a client metadata URL and its DNS to make the server connect to internal or loopback addresses.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003epublic_ip?/1\u003c/code\u003e in \u003ccode\u003eAshAuthentication.Oauth2Server.CIMD.ReqFetcher\u003c/code\u003e enforces the outbound policy for CIMD metadata fetches. It classified several address forms as publicly routable that are not: IPv4-compatible \u003ccode\u003e::/96\u003c/code\u003e (for example \u003ccode\u003e::127.0.0.1\u003c/code\u003e), SIIT IPv4-translated \u003ccode\u003e::ffff:0:0:0/96\u003c/code\u003e, and deprecated site-local \u003ccode\u003efec0::/10\u003c/code\u003e. A returned AAAA record in one of these ranges passed the policy, so a fetch pinned to that address reached space the policy was meant to block.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_authentication_oauth2_server: from 0.3.0 before 0.3.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Server-Side Request Forgery (SSRF) vulnerability in ash-project ash_authentication_oauth2_server allows an attacker who controls a client metadata URL and its DNS to make the server connect to internal or loopback addresses.\n\n`public_ip?/1` in `AshAuthentication.Oauth2Server.CIMD.ReqFetcher` enforces the outbound policy for CIMD metadata fetches. It classified several address forms as publicly routable that are not: IPv4-compatible `::/96` (for example `::127.0.0.1`), SIIT IPv4-translated `::ffff:0:0:0/96`, and deprecated site-local `fec0::/10`. A returned AAAA record in one of these ranges passed the policy, so a fetch pinned to that address reached space the policy was meant to block.\n\nThis issue affects ash_authentication_oauth2_server: from 0.3.0 before 0.3.1."
}
],
"value": "Server-Side Request Forgery (SSRF) vulnerability in ash-project ash_authentication_oauth2_server allows an attacker who controls a client metadata URL and its DNS to make the server connect to internal or loopback addresses.\n\npublic_ip?/1 in AshAuthentication.Oauth2Server.CIMD.ReqFetcher enforces the outbound policy for CIMD metadata fetches. It classified several address forms as publicly routable that are not: IPv4-compatible ::/96 (for example ::127.0.0.1), SIIT IPv4-translated ::ffff:0:0:0/96, and deprecated site-local fec0::/10. A returned AAAA record in one of these ranges passed the policy, so a fetch pinned to that address reached space the policy was meant to block.\n\nThis issue affects ash_authentication_oauth2_server: from 0.3.0 before 0.3.1."
}
],
"impacts": [
{
"capecId": "CAPEC-664",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-664 Server Side Request Forgery"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T22:31:34.656Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash_authentication_oauth2_server/security/advisories/GHSA-wprp-8gvj-p6cv"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82757.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82757"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_authentication_oauth2_server/commit/268b591261a3473ab9b87272963e4dd2fd99d972"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "ash_authentication_oauth2_server CIMD fetcher classifies IPv4-in-IPv6 and site-local addresses as public, allowing SSRF"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82757",
"datePublished": "2026-09-07T22:31:34.656Z",
"dateReserved": "2026-08-31T01:00:10.817Z",
"dateUpdated": "2026-09-08T14:43:57.511Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82756 (GCVE-0-2026-82756)
Vulnerability from nvd – Published: 2026-09-07 22:30 – Updated: 2026-09-08 14:43
VLAI
EPSS
VEX
Title
ash_authentication_oauth2_server interpolates a tenant-derived value into the WWW-Authenticate challenge without escaping, allowing header parameter injection
Summary
Improper Encoding or Escaping of Output vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to inject arbitrary authentication parameters into the WWW-Authenticate challenge header.
BearerPlug and RequireScopePlug built the Bearer resource_metadata="..." challenge by interpolating a resource_metadata URL derived from the request tenant directly into the quoted value. In a multi-tenant application that sets the Ash tenant from request-controlled data (a subdomain, the Host, a path segment, or a header), a tenant containing a " closes the quoted value and appends attacker-chosen auth-params, including a second resource_metadata URL pointing at an attacker-controlled authorization server that spec-following clients follow. Carriage returns and line feeds are rejected by Plug, so this is parameter injection within one header, not response splitting.
This issue affects ash_authentication_oauth2_server: from 0.1.3 before 0.3.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 14:43 UTC
CWE
- CWE-116 - Improper Encoding or Escaping of Output
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash_authentication… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82756.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82756 | related |
| https://github.com/ash-project/ash_authentication… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_authentication_oauth2_server |
Affected:
0.1.3 , < 0.3.1
(semver)
cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:* |
|
| ash-project | ash_authentication_oauth2_server |
Affected:
99de0a1cacb5ef667c4533278b7c81ca98c00231 , < 09f97476715da031b136eaec7b2cda2363ad8149
(git)
cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82756",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T14:43:23.093058Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T14:43:33.571Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.BearerPlug\u0027",
"\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.RequireScopePlug\u0027"
],
"packageName": "ash_authentication_oauth2_server",
"packageURL": "pkg:hex/ash_authentication_oauth2_server",
"product": "ash_authentication_oauth2_server",
"programFiles": [
"lib/ash_authentication_phoenix/oauth2_server/bearer_plug.ex",
"lib/ash_authentication_phoenix/oauth2_server/require_scope_plug.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.BearerPlug\u0027:call/2"
},
{
"name": "\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.RequireScopePlug\u0027:call/2"
}
],
"repo": "https://github.com/ash-project/ash_authentication_oauth2_server",
"vendor": "ash-project",
"versions": [
{
"lessThan": "0.3.1",
"status": "affected",
"version": "0.1.3",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.BearerPlug\u0027",
"\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.RequireScopePlug\u0027"
],
"packageName": "ash-project/ash_authentication_oauth2_server",
"packageURL": "pkg:github/ash-project/ash_authentication_oauth2_server",
"product": "ash_authentication_oauth2_server",
"programFiles": [
"lib/ash_authentication_phoenix/oauth2_server/bearer_plug.ex",
"lib/ash_authentication_phoenix/oauth2_server/require_scope_plug.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.BearerPlug\u0027:call/2"
},
{
"name": "\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.RequireScopePlug\u0027:call/2"
}
],
"repo": "https://github.com/ash-project/ash_authentication_oauth2_server",
"vendor": "ash-project",
"versions": [
{
"lessThan": "09f97476715da031b136eaec7b2cda2363ad8149",
"status": "affected",
"version": "99de0a1cacb5ef667c4533278b7c81ca98c00231",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eReachable only in a multi-tenant application that derives the Ash tenant from request-controlled input (subdomain, \u003ccode\u003eHost\u003c/code\u003e, path, or header) and uses \u003ccode\u003eBearerPlug\u003c/code\u003e or \u003ccode\u003eRequireScopePlug\u003c/code\u003e; the tenant reaches the challenge through the server\u0027s tenant-aware \u003ccode\u003eresource_url\u003c/code\u003e.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Reachable only in a multi-tenant application that derives the Ash tenant from request-controlled input (subdomain, `Host`, path, or header) and uses `BearerPlug` or `RequireScopePlug`; the tenant reaches the challenge through the server\u0027s tenant-aware `resource_url`."
}
],
"value": "Reachable only in a multi-tenant application that derives the Ash tenant from request-controlled input (subdomain, Host, path, or header) and uses BearerPlug or RequireScopePlug; the tenant reaches the challenge through the server\u0027s tenant-aware resource_url."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.3.1",
"versionStartIncluding": "0.1.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Encoding or Escaping of Output vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to inject arbitrary authentication parameters into the \u003ccode\u003eWWW-Authenticate\u003c/code\u003e challenge header.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eBearerPlug\u003c/code\u003e and \u003ccode\u003eRequireScopePlug\u003c/code\u003e built the \u003ccode\u003eBearer resource_metadata=\"...\"\u003c/code\u003e challenge by interpolating a \u003ccode\u003eresource_metadata\u003c/code\u003e URL derived from the request tenant directly into the quoted value. In a multi-tenant application that sets the Ash tenant from request-controlled data (a subdomain, the \u003ccode\u003eHost\u003c/code\u003e, a path segment, or a header), a tenant containing a \u003ccode\u003e\"\u003c/code\u003e closes the quoted value and appends attacker-chosen auth-params, including a second \u003ccode\u003eresource_metadata\u003c/code\u003e URL pointing at an attacker-controlled authorization server that spec-following clients follow. Carriage returns and line feeds are rejected by Plug, so this is parameter injection within one header, not response splitting.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_authentication_oauth2_server: from 0.1.3 before 0.3.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Improper Encoding or Escaping of Output vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to inject arbitrary authentication parameters into the `WWW-Authenticate` challenge header.\n\n`BearerPlug` and `RequireScopePlug` built the `Bearer resource_metadata=\"...\"` challenge by interpolating a `resource_metadata` URL derived from the request tenant directly into the quoted value. In a multi-tenant application that sets the Ash tenant from request-controlled data (a subdomain, the `Host`, a path segment, or a header), a tenant containing a `\"` closes the quoted value and appends attacker-chosen auth-params, including a second `resource_metadata` URL pointing at an attacker-controlled authorization server that spec-following clients follow. Carriage returns and line feeds are rejected by Plug, so this is parameter injection within one header, not response splitting.\n\nThis issue affects ash_authentication_oauth2_server: from 0.1.3 before 0.3.1."
}
],
"value": "Improper Encoding or Escaping of Output vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to inject arbitrary authentication parameters into the WWW-Authenticate challenge header.\n\nBearerPlug and RequireScopePlug built the Bearer resource_metadata=\"...\" challenge by interpolating a resource_metadata URL derived from the request tenant directly into the quoted value. In a multi-tenant application that sets the Ash tenant from request-controlled data (a subdomain, the Host, a path segment, or a header), a tenant containing a \" closes the quoted value and appends attacker-chosen auth-params, including a second resource_metadata URL pointing at an attacker-controlled authorization server that spec-following clients follow. Carriage returns and line feeds are rejected by Plug, so this is parameter injection within one header, not response splitting.\n\nThis issue affects ash_authentication_oauth2_server: from 0.1.3 before 0.3.1."
}
],
"impacts": [
{
"capecId": "CAPEC-153",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-153 Input Data Manipulation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-116",
"description": "CWE-116 Improper Encoding or Escaping of Output",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T22:30:55.280Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash_authentication_oauth2_server/security/advisories/GHSA-2h3v-83jg-2qmm"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82756.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82756"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_authentication_oauth2_server/commit/09f97476715da031b136eaec7b2cda2363ad8149"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "ash_authentication_oauth2_server interpolates a tenant-derived value into the WWW-Authenticate challenge without escaping, allowing header parameter injection"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82756",
"datePublished": "2026-09-07T22:30:55.280Z",
"dateReserved": "2026-08-31T01:00:10.817Z",
"dateUpdated": "2026-09-08T14:43:33.571Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82755 (GCVE-0-2026-82755)
Vulnerability from nvd – Published: 2026-09-07 22:28 – Updated: 2026-09-08 14:42
VLAI
EPSS
VEX
Title
ash_authentication_oauth2_server serves tenant-specific OAuth metadata as publicly cacheable without Vary, enabling cross-tenant confusion
Summary
Use of Cache Containing Sensitive Information vulnerability in ash-project ash_authentication_oauth2_server allows a shared HTTP cache to serve one tenant's OAuth discovery metadata to another tenant's clients.
The RFC 8414 and RFC 9728 metadata endpoints in AshAuthentication.Phoenix.Oauth2Server.ProtocolRouter return tenant-specific values (issuer, authorization_endpoint, token_endpoint, jwks_uri) when a tenant is set, but sent them with Cache-Control: public, max-age=3600 and no Vary. When the tenant is derived from something other than the URL (a header or the Host) and a shared cache sits in front, the cache key is the URL alone, so a stored response for one tenant is served to another for up to an hour. Affected clients may then send authorization codes and secrets to the wrong tenant's token endpoint and validate tokens against the wrong keys.
This issue affects ash_authentication_oauth2_server: from 0.1.3 before 0.3.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 14:42 UTC
CWE
- CWE-524 - Use of Cache Containing Sensitive Information
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash_authentication… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82755.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82755 | related |
| https://github.com/ash-project/ash_authentication… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_authentication_oauth2_server |
Affected:
0.1.3 , < 0.3.1
(semver)
cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:* |
|
| ash-project | ash_authentication_oauth2_server |
Affected:
99de0a1cacb5ef667c4533278b7c81ca98c00231 , < 768d87f70e4e97ae1d2bf1606b5bf3f4d03f24a1
(git)
cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82755",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T14:42:10.746522Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T14:42:17.718Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.ProtocolRouter\u0027"
],
"packageName": "ash_authentication_oauth2_server",
"packageURL": "pkg:hex/ash_authentication_oauth2_server",
"product": "ash_authentication_oauth2_server",
"programFiles": [
"lib/ash_authentication_phoenix/oauth2_server/protocol_router.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.ProtocolRouter\u0027:call/2"
}
],
"repo": "https://github.com/ash-project/ash_authentication_oauth2_server",
"vendor": "ash-project",
"versions": [
{
"lessThan": "0.3.1",
"status": "affected",
"version": "0.1.3",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.ProtocolRouter\u0027"
],
"packageName": "ash-project/ash_authentication_oauth2_server",
"packageURL": "pkg:github/ash-project/ash_authentication_oauth2_server",
"product": "ash_authentication_oauth2_server",
"programFiles": [
"lib/ash_authentication_phoenix/oauth2_server/protocol_router.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.ProtocolRouter\u0027:call/2"
}
],
"repo": "https://github.com/ash-project/ash_authentication_oauth2_server",
"vendor": "ash-project",
"versions": [
{
"lessThan": "768d87f70e4e97ae1d2bf1606b5bf3f4d03f24a1",
"status": "affected",
"version": "99de0a1cacb5ef667c4533278b7c81ca98c00231",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eReachable only in a multi-tenant deployment where the tenant is derived from outside the request URL (a header or the \u003ccode\u003eHost\u003c/code\u003e) and a shared HTTP cache (CDN, reverse proxy) sits in front of the metadata endpoints.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Reachable only in a multi-tenant deployment where the tenant is derived from outside the request URL (a header or the `Host`) and a shared HTTP cache (CDN, reverse proxy) sits in front of the metadata endpoints."
}
],
"value": "Reachable only in a multi-tenant deployment where the tenant is derived from outside the request URL (a header or the Host) and a shared HTTP cache (CDN, reverse proxy) sits in front of the metadata endpoints."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.3.1",
"versionStartIncluding": "0.1.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUse of Cache Containing Sensitive Information vulnerability in ash-project ash_authentication_oauth2_server allows a shared HTTP cache to serve one tenant\u0027s OAuth discovery metadata to another tenant\u0027s clients.\u003c/p\u003e\n\u003cp\u003eThe RFC 8414 and RFC 9728 metadata endpoints in \u003ccode\u003eAshAuthentication.Phoenix.Oauth2Server.ProtocolRouter\u003c/code\u003e return tenant-specific values (\u003ccode\u003eissuer\u003c/code\u003e, \u003ccode\u003eauthorization_endpoint\u003c/code\u003e, \u003ccode\u003etoken_endpoint\u003c/code\u003e, \u003ccode\u003ejwks_uri\u003c/code\u003e) when a tenant is set, but sent them with \u003ccode\u003eCache-Control: public, max-age=3600\u003c/code\u003e and no \u003ccode\u003eVary\u003c/code\u003e. When the tenant is derived from something other than the URL (a header or the \u003ccode\u003eHost\u003c/code\u003e) and a shared cache sits in front, the cache key is the URL alone, so a stored response for one tenant is served to another for up to an hour. Affected clients may then send authorization codes and secrets to the wrong tenant\u0027s token endpoint and validate tokens against the wrong keys.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_authentication_oauth2_server: from 0.1.3 before 0.3.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Use of Cache Containing Sensitive Information vulnerability in ash-project ash_authentication_oauth2_server allows a shared HTTP cache to serve one tenant\u0027s OAuth discovery metadata to another tenant\u0027s clients.\n\nThe RFC 8414 and RFC 9728 metadata endpoints in `AshAuthentication.Phoenix.Oauth2Server.ProtocolRouter` return tenant-specific values (`issuer`, `authorization_endpoint`, `token_endpoint`, `jwks_uri`) when a tenant is set, but sent them with `Cache-Control: public, max-age=3600` and no `Vary`. When the tenant is derived from something other than the URL (a header or the `Host`) and a shared cache sits in front, the cache key is the URL alone, so a stored response for one tenant is served to another for up to an hour. Affected clients may then send authorization codes and secrets to the wrong tenant\u0027s token endpoint and validate tokens against the wrong keys.\n\nThis issue affects ash_authentication_oauth2_server: from 0.1.3 before 0.3.1."
}
],
"value": "Use of Cache Containing Sensitive Information vulnerability in ash-project ash_authentication_oauth2_server allows a shared HTTP cache to serve one tenant\u0027s OAuth discovery metadata to another tenant\u0027s clients.\n\nThe RFC 8414 and RFC 9728 metadata endpoints in AshAuthentication.Phoenix.Oauth2Server.ProtocolRouter return tenant-specific values (issuer, authorization_endpoint, token_endpoint, jwks_uri) when a tenant is set, but sent them with Cache-Control: public, max-age=3600 and no Vary. When the tenant is derived from something other than the URL (a header or the Host) and a shared cache sits in front, the cache key is the URL alone, so a stored response for one tenant is served to another for up to an hour. Affected clients may then send authorization codes and secrets to the wrong tenant\u0027s token endpoint and validate tokens against the wrong keys.\n\nThis issue affects ash_authentication_oauth2_server: from 0.1.3 before 0.3.1."
}
],
"impacts": [
{
"capecId": "CAPEC-204",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-204 Lifting Sensitive Data Embedded in Cache"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-524",
"description": "CWE-524 Use of Cache Containing Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T22:28:24.500Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash_authentication_oauth2_server/security/advisories/GHSA-crqf-7m54-4hgc"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82755.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82755"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_authentication_oauth2_server/commit/768d87f70e4e97ae1d2bf1606b5bf3f4d03f24a1"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "ash_authentication_oauth2_server serves tenant-specific OAuth metadata as publicly cacheable without Vary, enabling cross-tenant confusion"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82755",
"datePublished": "2026-09-07T22:28:24.500Z",
"dateReserved": "2026-08-31T01:00:10.817Z",
"dateUpdated": "2026-09-08T14:42:17.718Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82754 (GCVE-0-2026-82754)
Vulnerability from nvd – Published: 2026-09-07 22:23 – Updated: 2026-09-08 14:41
VLAI
EPSS
VEX
Title
ash_authentication_oauth2_server aliases every protocol endpoint under /.well-known, bypassing path-scoped controls
Summary
Improper Protection of Alternate Path vulnerability in ash-project ash_authentication_oauth2_server exposes the state-changing OAuth endpoints under an unintended URL prefix, bypassing controls scoped to the canonical prefix.
oauth2_server_protocol_routes/1 in AshAuthentication.Phoenix.Oauth2Server.Router forwards the same ProtocolRouter at both the /oauth prefix and the /.well-known prefix. Phoenix forward strips the matched prefix before dispatch, so the full route table answers under both mounts, and POST /register, POST /token, and POST /revoke are reachable as /.well-known/register, /.well-known/token, and /.well-known/revoke. Edge controls such as WAF rules, rate limits, or authentication exemptions written against the /oauth paths, or that allow-list /.well-known as unauthenticated, do not apply to the alias.
This issue affects ash_authentication_oauth2_server: from 0.1.0 before 0.3.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 14:41 UTC
CWE
- CWE-424 - Improper Protection of Alternate Path
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash_authentication… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82754.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82754 | related |
| https://github.com/ash-project/ash_authentication… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_authentication_oauth2_server |
Affected:
0.1.0 , < 0.3.1
(semver)
cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:* |
|
| ash-project | ash_authentication_oauth2_server |
Affected:
855b578037c5ded18e8a6e60f42e56bde4905fae , < a72972d7ed3eb74c05dfa0653a258ef14454459a
(git)
cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82754",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T14:41:33.862078Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T14:41:45.077Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.Router\u0027",
"\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.ProtocolRouter\u0027"
],
"packageName": "ash_authentication_oauth2_server",
"packageURL": "pkg:hex/ash_authentication_oauth2_server",
"product": "ash_authentication_oauth2_server",
"programFiles": [
"lib/ash_authentication_phoenix/oauth2_server/router.ex",
"lib/ash_authentication_phoenix/oauth2_server/protocol_router.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.Router\u0027:oauth2_server_protocol_routes/1"
},
{
"name": "\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.ProtocolRouter\u0027:call/2"
}
],
"repo": "https://github.com/ash-project/ash_authentication_oauth2_server",
"vendor": "ash-project",
"versions": [
{
"lessThan": "0.3.1",
"status": "affected",
"version": "0.1.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.Router\u0027",
"\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.ProtocolRouter\u0027"
],
"packageName": "ash-project/ash_authentication_oauth2_server",
"packageURL": "pkg:github/ash-project/ash_authentication_oauth2_server",
"product": "ash_authentication_oauth2_server",
"programFiles": [
"lib/ash_authentication_phoenix/oauth2_server/router.ex",
"lib/ash_authentication_phoenix/oauth2_server/protocol_router.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.Router\u0027:oauth2_server_protocol_routes/1"
},
{
"name": "\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.ProtocolRouter\u0027:call/2"
}
],
"repo": "https://github.com/ash-project/ash_authentication_oauth2_server",
"vendor": "ash-project",
"versions": [
{
"lessThan": "a72972d7ed3eb74c05dfa0653a258ef14454459a",
"status": "affected",
"version": "855b578037c5ded18e8a6e60f42e56bde4905fae",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe routing alias is unconditional. Exploitable impact depends on the deployment applying path-scoped edge controls (WAF, rate limiting, auth-redirect exemptions) to the \u003ccode\u003e/oauth\u003c/code\u003e prefix, or allow-listing \u003ccode\u003e/.well-known\u003c/code\u003e as unauthenticated, that the alias then bypasses.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "The routing alias is unconditional. Exploitable impact depends on the deployment applying path-scoped edge controls (WAF, rate limiting, auth-redirect exemptions) to the `/oauth` prefix, or allow-listing `/.well-known` as unauthenticated, that the alias then bypasses."
}
],
"value": "The routing alias is unconditional. Exploitable impact depends on the deployment applying path-scoped edge controls (WAF, rate limiting, auth-redirect exemptions) to the /oauth prefix, or allow-listing /.well-known as unauthenticated, that the alias then bypasses."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.3.1",
"versionStartIncluding": "0.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Protection of Alternate Path vulnerability in ash-project ash_authentication_oauth2_server exposes the state-changing OAuth endpoints under an unintended URL prefix, bypassing controls scoped to the canonical prefix.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eoauth2_server_protocol_routes/1\u003c/code\u003e in \u003ccode\u003eAshAuthentication.Phoenix.Oauth2Server.Router\u003c/code\u003e forwards the same \u003ccode\u003eProtocolRouter\u003c/code\u003e at both the \u003ccode\u003e/oauth\u003c/code\u003e prefix and the \u003ccode\u003e/.well-known\u003c/code\u003e prefix. Phoenix \u003ccode\u003eforward\u003c/code\u003e strips the matched prefix before dispatch, so the full route table answers under both mounts, and \u003ccode\u003ePOST /register\u003c/code\u003e, \u003ccode\u003ePOST /token\u003c/code\u003e, and \u003ccode\u003ePOST /revoke\u003c/code\u003e are reachable as \u003ccode\u003e/.well-known/register\u003c/code\u003e, \u003ccode\u003e/.well-known/token\u003c/code\u003e, and \u003ccode\u003e/.well-known/revoke\u003c/code\u003e. Edge controls such as WAF rules, rate limits, or authentication exemptions written against the \u003ccode\u003e/oauth\u003c/code\u003e paths, or that allow-list \u003ccode\u003e/.well-known\u003c/code\u003e as unauthenticated, do not apply to the alias.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_authentication_oauth2_server: from 0.1.0 before 0.3.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Improper Protection of Alternate Path vulnerability in ash-project ash_authentication_oauth2_server exposes the state-changing OAuth endpoints under an unintended URL prefix, bypassing controls scoped to the canonical prefix.\n\n`oauth2_server_protocol_routes/1` in `AshAuthentication.Phoenix.Oauth2Server.Router` forwards the same `ProtocolRouter` at both the `/oauth` prefix and the `/.well-known` prefix. Phoenix `forward` strips the matched prefix before dispatch, so the full route table answers under both mounts, and `POST /register`, `POST /token`, and `POST /revoke` are reachable as `/.well-known/register`, `/.well-known/token`, and `/.well-known/revoke`. Edge controls such as WAF rules, rate limits, or authentication exemptions written against the `/oauth` paths, or that allow-list `/.well-known` as unauthenticated, do not apply to the alias.\n\nThis issue affects ash_authentication_oauth2_server: from 0.1.0 before 0.3.1."
}
],
"value": "Improper Protection of Alternate Path vulnerability in ash-project ash_authentication_oauth2_server exposes the state-changing OAuth endpoints under an unintended URL prefix, bypassing controls scoped to the canonical prefix.\n\noauth2_server_protocol_routes/1 in AshAuthentication.Phoenix.Oauth2Server.Router forwards the same ProtocolRouter at both the /oauth prefix and the /.well-known prefix. Phoenix forward strips the matched prefix before dispatch, so the full route table answers under both mounts, and POST /register, POST /token, and POST /revoke are reachable as /.well-known/register, /.well-known/token, and /.well-known/revoke. Edge controls such as WAF rules, rate limits, or authentication exemptions written against the /oauth paths, or that allow-list /.well-known as unauthenticated, do not apply to the alias.\n\nThis issue affects ash_authentication_oauth2_server: from 0.1.0 before 0.3.1."
}
],
"impacts": [
{
"capecId": "CAPEC-554",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-554 Functionality Bypass"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-424",
"description": "CWE-424 Improper Protection of Alternate Path",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T22:23:56.762Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash_authentication_oauth2_server/security/advisories/GHSA-wwxg-h779-3wf4"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82754.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82754"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_authentication_oauth2_server/commit/a72972d7ed3eb74c05dfa0653a258ef14454459a"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "ash_authentication_oauth2_server aliases every protocol endpoint under /.well-known, bypassing path-scoped controls"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82754",
"datePublished": "2026-09-07T22:23:56.762Z",
"dateReserved": "2026-08-31T01:00:10.817Z",
"dateUpdated": "2026-09-08T14:41:45.077Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82753 (GCVE-0-2026-82753)
Vulnerability from nvd – Published: 2026-09-07 22:23 – Updated: 2026-09-08 14:39
VLAI
EPSS
VEX
Title
Unauthenticated authorize requests create unbounded, never-expiring CIMD client rows and cache entries in ash_authentication_oauth2_server
Summary
Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to exhaust database storage and memory.
The /authorize endpoint is unauthenticated by design. With Client ID Metadata Documents enabled, resolve_client/3 in AshAuthentication.Oauth2Server.CIMD fetches the document for each new URL-shaped client_id and upserts a client row, with no cap on the number of rows, no expiry or garbage collection, and no length bound on the fetched fields; the document was also placed in CIMD.Cache before validation, so even rejected documents held cache memory until their TTL. An attacker serving valid documents at many distinct URLs creates one permanent client row per URL, each able to carry multi-megabyte strings, growing storage and memory without bound.
This issue affects ash_authentication_oauth2_server: from 0.3.0 before 0.3.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 14:39 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash_authentication… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82753.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82753 | related |
| https://github.com/ash-project/ash_authentication… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_authentication_oauth2_server |
Affected:
0.3.0 , < 0.3.1
(semver)
cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:* |
|
| ash-project | ash_authentication_oauth2_server |
Affected:
e713a9ba816761140c226e2ca55b75c0b93f5984 , < 45e24f69e0f95d67413e2508acc2264156acb5ac
(git)
cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82753",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T14:39:20.932056Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T14:39:54.464Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAuthentication.Oauth2Server.CIMD\u0027"
],
"packageName": "ash_authentication_oauth2_server",
"packageURL": "pkg:hex/ash_authentication_oauth2_server",
"product": "ash_authentication_oauth2_server",
"programFiles": [
"lib/ash_authentication/oauth2_server/cimd.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAuthentication.Oauth2Server.CIMD\u0027:resolve_client/3"
}
],
"repo": "https://github.com/ash-project/ash_authentication_oauth2_server",
"vendor": "ash-project",
"versions": [
{
"lessThan": "0.3.1",
"status": "affected",
"version": "0.3.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAuthentication.Oauth2Server.CIMD\u0027"
],
"packageName": "ash-project/ash_authentication_oauth2_server",
"packageURL": "pkg:github/ash-project/ash_authentication_oauth2_server",
"product": "ash_authentication_oauth2_server",
"programFiles": [
"lib/ash_authentication/oauth2_server/cimd.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAuthentication.Oauth2Server.CIMD\u0027:resolve_client/3"
}
],
"repo": "https://github.com/ash-project/ash_authentication_oauth2_server",
"vendor": "ash-project",
"versions": [
{
"lessThan": "45e24f69e0f95d67413e2508acc2264156acb5ac",
"status": "affected",
"version": "e713a9ba816761140c226e2ca55b75c0b93f5984",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eReachable only when the client resource has Client ID Metadata Documents enabled (\u003ccode\u003ecimd_enabled?: true\u003c/code\u003e) and the authorize endpoint is exposed. CIMD is off by default.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Reachable only when the client resource has Client ID Metadata Documents enabled (`cimd_enabled?: true`) and the authorize endpoint is exposed. CIMD is off by default."
}
],
"value": "Reachable only when the client resource has Client ID Metadata Documents enabled (cimd_enabled?: true) and the authorize endpoint is exposed. CIMD is off by default."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.3.1",
"versionStartIncluding": "0.3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAllocation of Resources Without Limits or Throttling vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to exhaust database storage and memory.\u003c/p\u003e\n\u003cp\u003eThe \u003ccode\u003e/authorize\u003c/code\u003e endpoint is unauthenticated by design. With Client ID Metadata Documents enabled, \u003ccode\u003eresolve_client/3\u003c/code\u003e in \u003ccode\u003eAshAuthentication.Oauth2Server.CIMD\u003c/code\u003e fetches the document for each new URL-shaped \u003ccode\u003eclient_id\u003c/code\u003e and upserts a client row, with no cap on the number of rows, no expiry or garbage collection, and no length bound on the fetched fields; the document was also placed in \u003ccode\u003eCIMD.Cache\u003c/code\u003e before validation, so even rejected documents held cache memory until their TTL. An attacker serving valid documents at many distinct URLs creates one permanent client row per URL, each able to carry multi-megabyte strings, growing storage and memory without bound.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_authentication_oauth2_server: from 0.3.0 before 0.3.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to exhaust database storage and memory.\n\nThe `/authorize` endpoint is unauthenticated by design. With Client ID Metadata Documents enabled, `resolve_client/3` in `AshAuthentication.Oauth2Server.CIMD` fetches the document for each new URL-shaped `client_id` and upserts a client row, with no cap on the number of rows, no expiry or garbage collection, and no length bound on the fetched fields; the document was also placed in `CIMD.Cache` before validation, so even rejected documents held cache memory until their TTL. An attacker serving valid documents at many distinct URLs creates one permanent client row per URL, each able to carry multi-megabyte strings, growing storage and memory without bound.\n\nThis issue affects ash_authentication_oauth2_server: from 0.3.0 before 0.3.1."
}
],
"value": "Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to exhaust database storage and memory.\n\nThe /authorize endpoint is unauthenticated by design. With Client ID Metadata Documents enabled, resolve_client/3 in AshAuthentication.Oauth2Server.CIMD fetches the document for each new URL-shaped client_id and upserts a client row, with no cap on the number of rows, no expiry or garbage collection, and no length bound on the fetched fields; the document was also placed in CIMD.Cache before validation, so even rejected documents held cache memory until their TTL. An attacker serving valid documents at many distinct URLs creates one permanent client row per URL, each able to carry multi-megabyte strings, growing storage and memory without bound.\n\nThis issue affects ash_authentication_oauth2_server: from 0.3.0 before 0.3.1."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-130 Excessive Allocation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T22:23:08.176Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash_authentication_oauth2_server/security/advisories/GHSA-9pv3-wxjm-f846"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82753.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82753"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_authentication_oauth2_server/commit/45e24f69e0f95d67413e2508acc2264156acb5ac"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Unauthenticated authorize requests create unbounded, never-expiring CIMD client rows and cache entries in ash_authentication_oauth2_server"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82753",
"datePublished": "2026-09-07T22:23:08.176Z",
"dateReserved": "2026-08-31T01:00:10.817Z",
"dateUpdated": "2026-09-08T14:39:54.464Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82586 (GCVE-0-2026-82586)
Vulnerability from nvd – Published: 2026-09-07 22:34 – Updated: 2026-09-08 14:44
VLAI
EPSS
VEX
Title
AshLua read operation aggregate bypasses the exposed-field allow-list, exposing private attributes
Summary
Improper Protection of Alternate Path vulnerability in ash-project ash_lua allows a user-supplied Lua script to read attributes that are not on the exposed-field allow-list.
AshLua exposes Ash resources to Lua scripts, gated by a manifest declaring which fields are exposed. The read action's operation aggregate path in AshLua.Runtime took the field name straight from the Lua call and resolved it with only String.to_existing_atom and Ash.Query.Aggregate.new!, neither of which consults the exposed-field allow-list the normal fields path enforces. A script can therefore read the value of any attribute of any record the actor may read, including private sensitive?: true columns, via resource.read({ operation = {"list", "hashed_password"} }); min and max give a value oracle. Anyone able to submit or influence a Lua script can reach this.
This issue affects ash_lua: from 0.1.0 before 0.2.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 14:44 UTC
CWE
- CWE-424 - Improper Protection of Alternate Path
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash_lua/security/a… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82586.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82586 | related |
| https://github.com/ash-project/ash_lua/commit/c0d… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_lua |
Affected:
0.1.0 , < 0.2.1
(semver)
cpe:2.3:a:ash-project:ash_lua:*:*:*:*:*:*:*:* |
|
| ash-project | ash_lua |
Affected:
8675e47cca81f36594083a7e63379bac9e123e72 , < c0dfcd9494766d548178c37df0bd01cff378e1c7
(git)
cpe:2.3:a:ash-project:ash_lua:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82586",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T14:44:32.288129Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T14:44:37.935Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_lua:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshLua.Runtime\u0027"
],
"packageName": "ash_lua",
"packageURL": "pkg:hex/ash_lua",
"product": "ash_lua",
"programFiles": [
"lib/ash_lua/runtime.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshLua.Runtime\u0027:eval!/2"
}
],
"repo": "https://github.com/ash-project/ash_lua",
"vendor": "ash-project",
"versions": [
{
"lessThan": "0.2.1",
"status": "affected",
"version": "0.1.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_lua:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshLua.Runtime\u0027"
],
"packageName": "ash-project/ash_lua",
"packageURL": "pkg:github/ash-project/ash_lua",
"product": "ash_lua",
"programFiles": [
"lib/ash_lua/runtime.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshLua.Runtime\u0027:eval!/2"
}
],
"repo": "https://github.com/ash-project/ash_lua",
"vendor": "ash-project",
"versions": [
{
"lessThan": "c0dfcd9494766d548178c37df0bd01cff378e1c7",
"status": "affected",
"version": "8675e47cca81f36594083a7e63379bac9e123e72",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eReachable only when an application exposes AshLua scripting (the \u003ccode\u003eAshLua.Resource\u003c/code\u003e / \u003ccode\u003eAshLua.Domain\u003c/code\u003e extensions) to callers who can submit or influence Lua scripts, and the exposed resource has attributes that are not on the exposed-field surface.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Reachable only when an application exposes AshLua scripting (the `AshLua.Resource` / `AshLua.Domain` extensions) to callers who can submit or influence Lua scripts, and the exposed resource has attributes that are not on the exposed-field surface."
}
],
"value": "Reachable only when an application exposes AshLua scripting (the AshLua.Resource / AshLua.Domain extensions) to callers who can submit or influence Lua scripts, and the exposed resource has attributes that are not on the exposed-field surface."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_lua:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.2.1",
"versionStartIncluding": "0.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Protection of Alternate Path vulnerability in ash-project ash_lua allows a user-supplied Lua script to read attributes that are not on the exposed-field allow-list.\u003c/p\u003e\n\u003cp\u003eAshLua exposes Ash resources to Lua scripts, gated by a manifest declaring which fields are exposed. The \u003ccode\u003eread\u003c/code\u003e action\u0027s \u003ccode\u003eoperation\u003c/code\u003e aggregate path in \u003ccode\u003eAshLua.Runtime\u003c/code\u003e took the field name straight from the Lua call and resolved it with only \u003ccode\u003eString.to_existing_atom\u003c/code\u003e and \u003ccode\u003eAsh.Query.Aggregate.new!\u003c/code\u003e, neither of which consults the exposed-field allow-list the normal \u003ccode\u003efields\u003c/code\u003e path enforces. A script can therefore read the value of any attribute of any record the actor may read, including private \u003ccode\u003esensitive?: true\u003c/code\u003e columns, via \u003ccode\u003eresource.read({ operation = {\"list\", \"hashed_password\"} })\u003c/code\u003e; \u003ccode\u003emin\u003c/code\u003e and \u003ccode\u003emax\u003c/code\u003e give a value oracle. Anyone able to submit or influence a Lua script can reach this.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_lua: from 0.1.0 before 0.2.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Improper Protection of Alternate Path vulnerability in ash-project ash_lua allows a user-supplied Lua script to read attributes that are not on the exposed-field allow-list.\n\nAshLua exposes Ash resources to Lua scripts, gated by a manifest declaring which fields are exposed. The `read` action\u0027s `operation` aggregate path in `AshLua.Runtime` took the field name straight from the Lua call and resolved it with only `String.to_existing_atom` and `Ash.Query.Aggregate.new!`, neither of which consults the exposed-field allow-list the normal `fields` path enforces. A script can therefore read the value of any attribute of any record the actor may read, including private `sensitive?: true` columns, via `resource.read({ operation = {\"list\", \"hashed_password\"} })`; `min` and `max` give a value oracle. Anyone able to submit or influence a Lua script can reach this.\n\nThis issue affects ash_lua: from 0.1.0 before 0.2.1."
}
],
"value": "Improper Protection of Alternate Path vulnerability in ash-project ash_lua allows a user-supplied Lua script to read attributes that are not on the exposed-field allow-list.\n\nAshLua exposes Ash resources to Lua scripts, gated by a manifest declaring which fields are exposed. The read action\u0027s operation aggregate path in AshLua.Runtime took the field name straight from the Lua call and resolved it with only String.to_existing_atom and Ash.Query.Aggregate.new!, neither of which consults the exposed-field allow-list the normal fields path enforces. A script can therefore read the value of any attribute of any record the actor may read, including private sensitive?: true columns, via resource.read({ operation = {\"list\", \"hashed_password\"} }); min and max give a value oracle. Anyone able to submit or influence a Lua script can reach this.\n\nThis issue affects ash_lua: from 0.1.0 before 0.2.1."
}
],
"impacts": [
{
"capecId": "CAPEC-554",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-554 Functionality Bypass"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-424",
"description": "CWE-424 Improper Protection of Alternate Path",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T22:34:14.837Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash_lua/security/advisories/GHSA-37jv-wc37-fhcw"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82586.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82586"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_lua/commit/c0dfcd9494766d548178c37df0bd01cff378e1c7"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "AshLua read operation aggregate bypasses the exposed-field allow-list, exposing private attributes"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82586",
"datePublished": "2026-09-07T22:34:14.837Z",
"dateReserved": "2026-09-07T19:30:01.631Z",
"dateUpdated": "2026-09-08T14:44:37.935Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82584 (GCVE-0-2026-82584)
Vulnerability from nvd – Published: 2026-09-07 22:54 – Updated: 2026-09-08 14:44
VLAI
EPSS
VEX
Title
Terminal escape sequence injection in the mix igniter.install confirmation prompt via package metadata
Summary
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project igniter allows a malicious package publisher to forge the mix igniter.install confirmation prompt.
mix igniter.install prints a confirmation panel (an anti-typosquatting safeguard) listing a package's hex metadata before adding it. The panel builder in Igniter.Project.Deps wrote publisher-controlled fields (meta.description, owner usernames, requirement names, version) to the terminal with only newlines stripped. A malicious or typosquatted package can embed ANSI terminal escape sequences (cursor movement, line erase, carriage returns) in its metadata to overwrite the panel, forging trusted author names and download counts while concealing the real ones, so a developer relying on the panel to vet the package is deceived into approving a malicious dependency.
This issue affects igniter: from 0.8.1 before 0.8.4.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 14:44 UTC
CWE
- CWE-150 - Improper Neutralization of Escape, Meta, or Control Sequences
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/igniter/security/a… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82584.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82584 | related |
| https://github.com/ash-project/igniter/commit/d49… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | igniter |
Affected:
0.8.1 , < 0.8.4
(semver)
cpe:2.3:a:ash-project:igniter:*:*:*:*:*:*:*:* |
|
| ash-project | igniter |
Affected:
d26d9b3a8348661813617606076315075d32663b , < d492b1aa33f8fb0dacc0afa41b703fb922d42816
(git)
cpe:2.3:a:ash-project:igniter:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82584",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T14:44:50.539017Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T14:44:59.110Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:igniter:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Igniter.Project.Deps\u0027"
],
"packageName": "igniter",
"packageURL": "pkg:hex/igniter",
"product": "igniter",
"programFiles": [
"lib/igniter/project/deps.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Igniter.Project.Deps\u0027:determine_dep_type_and_version!/2"
}
],
"repo": "https://github.com/ash-project/igniter",
"vendor": "ash-project",
"versions": [
{
"lessThan": "0.8.4",
"status": "affected",
"version": "0.8.1",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:igniter:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Igniter.Project.Deps\u0027"
],
"packageName": "ash-project/igniter",
"packageURL": "pkg:github/ash-project/igniter",
"product": "igniter",
"programFiles": [
"lib/igniter/project/deps.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Igniter.Project.Deps\u0027:determine_dep_type_and_version!/2"
}
],
"repo": "https://github.com/ash-project/igniter",
"vendor": "ash-project",
"versions": [
{
"lessThan": "d492b1aa33f8fb0dacc0afa41b703fb922d42816",
"status": "affected",
"version": "d26d9b3a8348661813617606076315075d32663b",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eReachable only when a developer runs \u003ccode\u003emix igniter.install\u003c/code\u003e against an untrusted or misspelled package name in a terminal emulator that interprets ANSI escape sequences.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Reachable only when a developer runs `mix igniter.install` against an untrusted or misspelled package name in a terminal emulator that interprets ANSI escape sequences."
}
],
"value": "Reachable only when a developer runs mix igniter.install against an untrusted or misspelled package name in a terminal emulator that interprets ANSI escape sequences."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:igniter:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.8.4",
"versionStartIncluding": "0.8.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project igniter allows a malicious package publisher to forge the \u003ccode\u003emix igniter.install\u003c/code\u003e confirmation prompt.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003emix igniter.install\u003c/code\u003e prints a confirmation panel (an anti-typosquatting safeguard) listing a package\u0027s hex metadata before adding it. The panel builder in \u003ccode\u003eIgniter.Project.Deps\u003c/code\u003e wrote publisher-controlled fields (\u003ccode\u003emeta.description\u003c/code\u003e, owner usernames, requirement names, version) to the terminal with only newlines stripped. A malicious or typosquatted package can embed ANSI terminal escape sequences (cursor movement, line erase, carriage returns) in its metadata to overwrite the panel, forging trusted author names and download counts while concealing the real ones, so a developer relying on the panel to vet the package is deceived into approving a malicious dependency.\u003c/p\u003e\n\u003cp\u003eThis issue affects igniter: from 0.8.1 before 0.8.4.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project igniter allows a malicious package publisher to forge the `mix igniter.install` confirmation prompt.\n\n`mix igniter.install` prints a confirmation panel (an anti-typosquatting safeguard) listing a package\u0027s hex metadata before adding it. The panel builder in `Igniter.Project.Deps` wrote publisher-controlled fields (`meta.description`, owner usernames, requirement names, version) to the terminal with only newlines stripped. A malicious or typosquatted package can embed ANSI terminal escape sequences (cursor movement, line erase, carriage returns) in its metadata to overwrite the panel, forging trusted author names and download counts while concealing the real ones, so a developer relying on the panel to vet the package is deceived into approving a malicious dependency.\n\nThis issue affects igniter: from 0.8.1 before 0.8.4."
}
],
"value": "Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project igniter allows a malicious package publisher to forge the mix igniter.install confirmation prompt.\n\nmix igniter.install prints a confirmation panel (an anti-typosquatting safeguard) listing a package\u0027s hex metadata before adding it. The panel builder in Igniter.Project.Deps wrote publisher-controlled fields (meta.description, owner usernames, requirement names, version) to the terminal with only newlines stripped. A malicious or typosquatted package can embed ANSI terminal escape sequences (cursor movement, line erase, carriage returns) in its metadata to overwrite the panel, forging trusted author names and download counts while concealing the real ones, so a developer relying on the panel to vet the package is deceived into approving a malicious dependency.\n\nThis issue affects igniter: from 0.8.1 before 0.8.4."
}
],
"impacts": [
{
"capecId": "CAPEC-93",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-93 Log Injection-Tampering-Forging"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-150",
"description": "CWE-150 Improper Neutralization of Escape, Meta, or Control Sequences",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T22:54:48.222Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/igniter/security/advisories/GHSA-cj7w-j579-gc42"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82584.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82584"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/igniter/commit/d492b1aa33f8fb0dacc0afa41b703fb922d42816"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Terminal escape sequence injection in the mix igniter.install confirmation prompt via package metadata"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82584",
"datePublished": "2026-09-07T22:54:48.222Z",
"dateReserved": "2026-09-07T21:00:01.988Z",
"dateUpdated": "2026-09-08T14:44:59.110Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-81638 (GCVE-0-2026-81638)
Vulnerability from nvd – Published: 2026-09-07 22:33 – Updated: 2026-09-08 14:44
VLAI
EPSS
VEX
Title
Non-canonical ULID spellings are accepted and alias to the same record in ash_double_entry
Summary
Improper Handling of Alternate Encoding vulnerability in ash-project ash_double_entry allows an attacker to submit several distinct string spellings of the same identifier.
AshDoubleEntry.ULID renders a 128-bit ULID as 26 Crockford base-32 characters, but the first character encodes only 3 bits, so canonical values are 0 to 7. decode/1 in lib/ulid.ex masks the first character to its low 3 bits and valid?/1 accepts all 32 characters in that position, so 0..., 8..., G... and R... decode to the identical 16-byte value and resolve to the same row. When the type is exposed as a public ID over an HTTP or API boundary, an attacker-supplied ID can be spelled differently from the record it actually reads or writes, desynchronizing or bypassing string-level checks such as idempotency and deduplication keys, deny-lists, audit correlation, or signatures computed over the submitted ID.
This issue affects ash_double_entry: from 0.1.0 before 1.0.19.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 14:44 UTC
CWE
- CWE-173 - Improper Handling of Alternate Encoding
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash_double_entry/s… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-81638.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-81638 | related |
| https://github.com/ash-project/ash_double_entry/c… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_double_entry |
Affected:
0.1.0 , < 1.0.19
(semver)
cpe:2.3:a:ash-project:ash_double_entry:*:*:*:*:*:*:*:* |
|
| ash-project | ash_double_entry |
Affected:
1e5f7ce8ff25f519c904731a29eb1258324e561a , < d3e688d300a581ae214b3ca7d95ef4de63fbb050
(git)
cpe:2.3:a:ash-project:ash_double_entry:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-81638",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T14:44:11.859893Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T14:44:19.138Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_double_entry:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshDoubleEntry.ULID\u0027"
],
"packageName": "ash_double_entry",
"packageURL": "pkg:hex/ash_double_entry",
"product": "ash_double_entry",
"programFiles": [
"lib/ulid.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshDoubleEntry.ULID\u0027:cast_input/2"
},
{
"name": "\u0027Elixir.AshDoubleEntry.ULID\u0027:dump_to_native/2"
}
],
"repo": "https://github.com/ash-project/ash_double_entry",
"vendor": "ash-project",
"versions": [
{
"lessThan": "1.0.19",
"status": "affected",
"version": "0.1.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_double_entry:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshDoubleEntry.ULID\u0027"
],
"packageName": "ash-project/ash_double_entry",
"packageURL": "pkg:github/ash-project/ash_double_entry",
"product": "ash_double_entry",
"programFiles": [
"lib/ulid.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshDoubleEntry.ULID\u0027:cast_input/2"
},
{
"name": "\u0027Elixir.AshDoubleEntry.ULID\u0027:dump_to_native/2"
}
],
"repo": "https://github.com/ash-project/ash_double_entry",
"vendor": "ash-project",
"versions": [
{
"lessThan": "d3e688d300a581ae214b3ca7d95ef4de63fbb050",
"status": "affected",
"version": "1e5f7ce8ff25f519c904731a29eb1258324e561a",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eReachable only when an application exposes \u003ccode\u003eAshDoubleEntry.ULID\u003c/code\u003e as a public identifier over an HTTP or API boundary and performs string-level checks on the submitted ID (idempotency or deduplication keys, deny-lists, audit correlation, or signatures) rather than treating the value as opaque.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Reachable only when an application exposes `AshDoubleEntry.ULID` as a public identifier over an HTTP or API boundary and performs string-level checks on the submitted ID (idempotency or deduplication keys, deny-lists, audit correlation, or signatures) rather than treating the value as opaque."
}
],
"value": "Reachable only when an application exposes AshDoubleEntry.ULID as a public identifier over an HTTP or API boundary and performs string-level checks on the submitted ID (idempotency or deduplication keys, deny-lists, audit correlation, or signatures) rather than treating the value as opaque."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_double_entry:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.0.19",
"versionStartIncluding": "0.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Handling of Alternate Encoding vulnerability in ash-project ash_double_entry allows an attacker to submit several distinct string spellings of the same identifier.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eAshDoubleEntry.ULID\u003c/code\u003e renders a 128-bit ULID as 26 Crockford base-32 characters, but the first character encodes only 3 bits, so canonical values are \u003ccode\u003e0\u003c/code\u003e to \u003ccode\u003e7\u003c/code\u003e. \u003ccode\u003edecode/1\u003c/code\u003e in \u003ccode\u003elib/ulid.ex\u003c/code\u003e masks the first character to its low 3 bits and \u003ccode\u003evalid?/1\u003c/code\u003e accepts all 32 characters in that position, so \u003ccode\u003e0...\u003c/code\u003e, \u003ccode\u003e8...\u003c/code\u003e, \u003ccode\u003eG...\u003c/code\u003e and \u003ccode\u003eR...\u003c/code\u003e decode to the identical 16-byte value and resolve to the same row. When the type is exposed as a public ID over an HTTP or API boundary, an attacker-supplied ID can be spelled differently from the record it actually reads or writes, desynchronizing or bypassing string-level checks such as idempotency and deduplication keys, deny-lists, audit correlation, or signatures computed over the submitted ID.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_double_entry: from 0.1.0 before 1.0.19.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Improper Handling of Alternate Encoding vulnerability in ash-project ash_double_entry allows an attacker to submit several distinct string spellings of the same identifier.\n\n`AshDoubleEntry.ULID` renders a 128-bit ULID as 26 Crockford base-32 characters, but the first character encodes only 3 bits, so canonical values are `0` to `7`. `decode/1` in `lib/ulid.ex` masks the first character to its low 3 bits and `valid?/1` accepts all 32 characters in that position, so `0...`, `8...`, `G...` and `R...` decode to the identical 16-byte value and resolve to the same row. When the type is exposed as a public ID over an HTTP or API boundary, an attacker-supplied ID can be spelled differently from the record it actually reads or writes, desynchronizing or bypassing string-level checks such as idempotency and deduplication keys, deny-lists, audit correlation, or signatures computed over the submitted ID.\n\nThis issue affects ash_double_entry: from 0.1.0 before 1.0.19."
}
],
"value": "Improper Handling of Alternate Encoding vulnerability in ash-project ash_double_entry allows an attacker to submit several distinct string spellings of the same identifier.\n\nAshDoubleEntry.ULID renders a 128-bit ULID as 26 Crockford base-32 characters, but the first character encodes only 3 bits, so canonical values are 0 to 7. decode/1 in lib/ulid.ex masks the first character to its low 3 bits and valid?/1 accepts all 32 characters in that position, so 0..., 8..., G... and R... decode to the identical 16-byte value and resolve to the same row. When the type is exposed as a public ID over an HTTP or API boundary, an attacker-supplied ID can be spelled differently from the record it actually reads or writes, desynchronizing or bypassing string-level checks such as idempotency and deduplication keys, deny-lists, audit correlation, or signatures computed over the submitted ID.\n\nThis issue affects ash_double_entry: from 0.1.0 before 1.0.19."
}
],
"impacts": [
{
"capecId": "CAPEC-267",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-267 Leverage Alternate Encoding"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 2.1,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-173",
"description": "CWE-173 Improper Handling of Alternate Encoding",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T22:33:29.297Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash_double_entry/security/advisories/GHSA-qxp2-vgp9-268q"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-81638.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-81638"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_double_entry/commit/d3e688d300a581ae214b3ca7d95ef4de63fbb050"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Non-canonical ULID spellings are accepted and alias to the same record in ash_double_entry"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-81638",
"datePublished": "2026-09-07T22:33:29.297Z",
"dateReserved": "2026-09-07T19:30:01.624Z",
"dateUpdated": "2026-09-08T14:44:19.138Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82752 (GCVE-0-2026-82752)
Vulnerability from nvd – Published: 2026-09-05 17:16 – Updated: 2026-09-08 18:20
VLAI
EPSS
VEX
Title
Ash string length constraints count graphemes, so a combining-mark string of any size passes max_length
Summary
Improper Validation of Specified Quantity in Input vulnerability in ash-project ash allows an attacker to store a value of arbitrary size in an attribute whose length constraint should bound it.
Ash measures string length with Elixir's String.length/1, which counts Unicode graphemes, in the max_length and min_length constraints of Ash.Type.String (apply_constraints/2 in lib/ash/type/string.ex), in Ash.Resource.Validation.StringLength, and in the string_length expression function. A grapheme carries an unbounded number of combining marks, so a base character followed by a million combining acute accents is one grapheme and megabytes of data, and satisfies max_length: 2. Where the data layer imposes no independent limit (ETS, Mnesia, or a Postgres text column) the whole value is persisted, so an attacker can write an entire request body into an attribute declared with a small maximum and grow storage without bound.
The counting unit also disagrees with the storage layer, which counts codepoints rather than graphemes, so a value accepted by the constraint can still be rejected or truncated by the column. A Postgres varchar(n) column bounds the value itself and is not exposed.
This issue affects ash: from 0.10.0 before 3.33.0.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 18:19 UTC
CWE
- CWE-1284 - Improper Validation of Specified Quantity in Input
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash/security/advis… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82752.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82752 | related |
| https://github.com/ash-project/ash/commit/a64cab4… | patch |
| https://github.com/ash-project/ash/commit/cdbf4c4… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash |
Affected:
0.10.0 , < 3.33.0
(semver)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
|
| ash-project | ash |
Affected:
05848d5f4affe60fddd812222a18ada080c0813b , < *
(git)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82752",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T18:19:23.967428Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T18:20:03.503Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Type.String\u0027",
"\u0027Elixir.Ash.Resource.Validation.StringLength\u0027",
"\u0027Elixir.Ash.Query.Function.StringLength\u0027"
],
"packageName": "ash",
"packageURL": "pkg:hex/ash",
"product": "ash",
"programFiles": [
"lib/ash/type/string.ex",
"lib/ash/resource/validation/string_length.ex",
"lib/ash/query/function/string_length.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Type.String\u0027:apply_constraints/2"
},
{
"name": "\u0027Elixir.Ash.Type.String\u0027:apply_atomic_constraints/2"
},
{
"name": "\u0027Elixir.Ash.Resource.Validation.StringLength\u0027:validate/3"
},
{
"name": "\u0027Elixir.Ash.Resource.Validation.StringLength\u0027:atomic/3"
},
{
"name": "\u0027Elixir.Ash.Query.Function.StringLength\u0027:evaluate/1"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "3.33.0",
"status": "affected",
"version": "0.10.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Type.String\u0027",
"\u0027Elixir.Ash.Resource.Validation.StringLength\u0027",
"\u0027Elixir.Ash.Query.Function.StringLength\u0027"
],
"packageName": "ash-project/ash",
"packageURL": "pkg:github/ash-project/ash",
"product": "ash",
"programFiles": [
"lib/ash/type/string.ex",
"lib/ash/resource/validation/string_length.ex",
"lib/ash/query/function/string_length.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Type.String\u0027:apply_constraints/2"
},
{
"name": "\u0027Elixir.Ash.Type.String\u0027:apply_atomic_constraints/2"
},
{
"name": "\u0027Elixir.Ash.Resource.Validation.StringLength\u0027:validate/3"
},
{
"name": "\u0027Elixir.Ash.Resource.Validation.StringLength\u0027:atomic/3"
},
{
"name": "\u0027Elixir.Ash.Query.Function.StringLength\u0027:evaluate/1"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"changes": [
{
"at": "a64cab49b8886503e6b7c7b211d83c475aac48ca",
"status": "unaffected"
},
{
"at": "cdbf4c4da6bda5f6f139078f01a64320b595216d",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "05848d5f4affe60fddd812222a18ada080c0813b",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA resource attribute must carry a \u003ccode\u003emax_length\u003c/code\u003e constraint (or an equivalent \u003ccode\u003estring_length\u003c/code\u003e validation) fed from client input, and the data layer must impose no independent size limit of its own. The ETS and Mnesia data layers and Postgres \u003ccode\u003etext\u003c/code\u003e columns store the value in full; a Postgres \u003ccode\u003evarchar(n)\u003c/code\u003e column bounds it independently and is not exposed.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "A resource attribute must carry a `max_length` constraint (or an equivalent `string_length` validation) fed from client input, and the data layer must impose no independent size limit of its own. The ETS and Mnesia data layers and Postgres `text` columns store the value in full; a Postgres `varchar(n)` column bounds it independently and is not exposed."
}
],
"value": "A resource attribute must carry a max_length constraint (or an equivalent string_length validation) fed from client input, and the data layer must impose no independent size limit of its own. The ETS and Mnesia data layers and Postgres text columns store the value in full; a Postgres varchar(n) column bounds it independently and is not exposed."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.33.0",
"versionStartIncluding": "0.10.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "reporter",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Validation of Specified Quantity in Input vulnerability in ash-project ash allows an attacker to store a value of arbitrary size in an attribute whose length constraint should bound it.\u003c/p\u003e\n\u003cp\u003eAsh measures string length with Elixir\u0027s \u003ccode\u003eString.length/1\u003c/code\u003e, which counts Unicode graphemes, in the \u003ccode\u003emax_length\u003c/code\u003e and \u003ccode\u003emin_length\u003c/code\u003e constraints of \u003ccode\u003eAsh.Type.String\u003c/code\u003e (\u003ccode\u003eapply_constraints/2\u003c/code\u003e in \u003ccode\u003elib/ash/type/string.ex\u003c/code\u003e), in \u003ccode\u003eAsh.Resource.Validation.StringLength\u003c/code\u003e, and in the \u003ccode\u003estring_length\u003c/code\u003e expression function. A grapheme carries an unbounded number of combining marks, so a base character followed by a million combining acute accents is one grapheme and megabytes of data, and satisfies \u003ccode\u003emax_length: 2\u003c/code\u003e. Where the data layer imposes no independent limit (ETS, Mnesia, or a Postgres \u003ccode\u003etext\u003c/code\u003e column) the whole value is persisted, so an attacker can write an entire request body into an attribute declared with a small maximum and grow storage without bound.\u003c/p\u003e\n\u003cp\u003eThe counting unit also disagrees with the storage layer, which counts codepoints rather than graphemes, so a value accepted by the constraint can still be rejected or truncated by the column. A Postgres \u003ccode\u003evarchar(n)\u003c/code\u003e column bounds the value itself and is not exposed.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash: from 0.10.0 before 3.33.0.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Improper Validation of Specified Quantity in Input vulnerability in ash-project ash allows an attacker to store a value of arbitrary size in an attribute whose length constraint should bound it.\n\nAsh measures string length with Elixir\u0027s `String.length/1`, which counts Unicode graphemes, in the `max_length` and `min_length` constraints of `Ash.Type.String` (`apply_constraints/2` in `lib/ash/type/string.ex`), in `Ash.Resource.Validation.StringLength`, and in the `string_length` expression function. A grapheme carries an unbounded number of combining marks, so a base character followed by a million combining acute accents is one grapheme and megabytes of data, and satisfies `max_length: 2`. Where the data layer imposes no independent limit (ETS, Mnesia, or a Postgres `text` column) the whole value is persisted, so an attacker can write an entire request body into an attribute declared with a small maximum and grow storage without bound.\n\nThe counting unit also disagrees with the storage layer, which counts codepoints rather than graphemes, so a value accepted by the constraint can still be rejected or truncated by the column. A Postgres `varchar(n)` column bounds the value itself and is not exposed.\n\nThis issue affects ash: from 0.10.0 before 3.33.0."
}
],
"value": "Improper Validation of Specified Quantity in Input vulnerability in ash-project ash allows an attacker to store a value of arbitrary size in an attribute whose length constraint should bound it.\n\nAsh measures string length with Elixir\u0027s String.length/1, which counts Unicode graphemes, in the max_length and min_length constraints of Ash.Type.String (apply_constraints/2 in lib/ash/type/string.ex), in Ash.Resource.Validation.StringLength, and in the string_length expression function. A grapheme carries an unbounded number of combining marks, so a base character followed by a million combining acute accents is one grapheme and megabytes of data, and satisfies max_length: 2. Where the data layer imposes no independent limit (ETS, Mnesia, or a Postgres text column) the whole value is persisted, so an attacker can write an entire request body into an attribute declared with a small maximum and grow storage without bound.\n\nThe counting unit also disagrees with the storage layer, which counts codepoints rather than graphemes, so a value accepted by the constraint can still be rejected or truncated by the column. A Postgres varchar(n) column bounds the value itself and is not exposed.\n\nThis issue affects ash: from 0.10.0 before 3.33.0."
}
],
"impacts": [
{
"capecId": "CAPEC-153",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-153 Input Data Manipulation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1284",
"description": "CWE-1284 Improper Validation of Specified Quantity in Input",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-05T17:16:16.722Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-cwjv-574p-59f6"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82752.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82752"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash/commit/a64cab49b8886503e6b7c7b211d83c475aac48ca"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash/commit/cdbf4c4da6bda5f6f139078f01a64320b595216d"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Ash string length constraints count graphemes, so a combining-mark string of any size passes max_length"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82752",
"datePublished": "2026-09-05T17:16:16.722Z",
"dateReserved": "2026-08-31T01:00:10.817Z",
"dateUpdated": "2026-09-08T18:20:03.503Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93477 (GCVE-0-2026-93477)
Vulnerability from cvelistv5 – Published: 2026-09-25 07:08 – Updated: 2026-09-25 13:26
VLAI
EPSS
VEX
Title
Private action arguments can be set by user input on the bulk destroy and bulk update paths in Ash
Summary
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash allows a user to set the value of a private action argument on the bulk destroy and bulk update paths.
Action arguments declared with public?: false are meant to be set only by trusted server-side code (for example via Ash.Changeset.set_private_argument/3) and must not be settable from end-user input. CVE-2026-55736 fixed the non-bulk changeset path to strip private arguments from user-supplied parameter maps, but the bulk destroy and bulk update paths were not covered.
Ash.Actions.Destroy.Bulk.base_changeset/5 and Ash.Actions.Update.Bulk.base_changeset/5 match every key in the caller-supplied parameter map against all of the action's arguments with no public? check, then apply the matches to the base changeset. A caller who can submit parameters to a bulk destroy or bulk update action (for example through AshJsonApi, AshGraphql, or a controller that forwards request parameters to Ash.bulk_destroy/4 or Ash.bulk_update/4) can therefore set any private argument of that action, including one referenced by an arg(...) template in the action's changes or validations. Depending on how the application uses the argument (for example an acting_user_id driving authorization or record ownership, or audit metadata), this can lead to an integrity violation or privilege escalation.
The fix requires public? in the argument matching on both bulk paths; private arguments remain settable server-side via the :private_arguments option.
This issue affects ash: from 2.17.15 before 3.33.11.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-25 13:26 UTC
CWE
- CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes
Assigner
References
5 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash |
Affected:
2.17.15 , < 3.33.11
(semver)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
|
| ash-project | ash |
Affected:
8c17434803b2e91de522bdfbd0ca918e5d5898df , < 6b7ac53a0a2532291eb940d7beaf0fbb2da6fc4f
(git)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-93477",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-25T13:26:14.200048Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T13:26:42.369Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-c2p4-p7q6-hr2j"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Actions.Destroy.Bulk\u0027",
"\u0027Elixir.Ash.Actions.Update.Bulk\u0027"
],
"packageName": "ash",
"packageURL": "pkg:hex/ash",
"product": "ash",
"programFiles": [
"lib/ash/actions/destroy/bulk.ex",
"lib/ash/actions/update/bulk.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Actions.Destroy.Bulk\u0027:base_changeset/5"
},
{
"name": "\u0027Elixir.Ash.Actions.Update.Bulk\u0027:base_changeset/5"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "3.33.11",
"status": "affected",
"version": "2.17.15",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Actions.Destroy.Bulk\u0027",
"\u0027Elixir.Ash.Actions.Update.Bulk\u0027"
],
"packageName": "ash-project/ash",
"packageURL": "pkg:github/ash-project/ash",
"product": "ash",
"programFiles": [
"lib/ash/actions/destroy/bulk.ex",
"lib/ash/actions/update/bulk.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Actions.Destroy.Bulk\u0027:base_changeset/5"
},
{
"name": "\u0027Elixir.Ash.Actions.Update.Bulk\u0027:base_changeset/5"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "6b7ac53a0a2532291eb940d7beaf0fbb2da6fc4f",
"status": "affected",
"version": "8c17434803b2e91de522bdfbd0ca918e5d5898df",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn action must declare a private argument (\u003ccode\u003epublic?: false\u003c/code\u003e) that is referenced by an \u003ccode\u003earg(...)\u003c/code\u003e template in one of its changes or validations, be invocable as a bulk destroy or bulk update, and the application must pass untrusted user-supplied parameters into \u003ccode\u003eAsh.bulk_destroy/4\u003c/code\u003e or \u003ccode\u003eAsh.bulk_update/4\u003c/code\u003e (directly or through AshJsonApi/AshGraphql).\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "An action must declare a private argument (`public?: false`) that is referenced by an `arg(...)` template in one of its changes or validations, be invocable as a bulk destroy or bulk update, and the application must pass untrusted user-supplied parameters into `Ash.bulk_destroy/4` or `Ash.bulk_update/4` (directly or through AshJsonApi/AshGraphql)."
}
],
"value": "An action must declare a private argument (public?: false) that is referenced by an arg(...) template in one of its changes or validations, be invocable as a bulk destroy or bulk update, and the application must pass untrusted user-supplied parameters into Ash.bulk_destroy/4 or Ash.bulk_update/4 (directly or through AshJsonApi/AshGraphql)."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.33.11",
"versionStartIncluding": "2.17.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "zx"
},
{
"lang": "en",
"type": "reporter",
"value": "zx"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"dateAssigned": "2026-09-25T06:50:10.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash allows a user to set the value of a private action argument on the bulk destroy and bulk update paths.\u003c/p\u003e\n\u003cp\u003eAction arguments declared with \u003ccode\u003epublic?: false\u003c/code\u003e are meant to be set only by trusted server-side code (for example via \u003ccode\u003eAsh.Changeset.set_private_argument/3\u003c/code\u003e) and must not be settable from end-user input. CVE-2026-55736 fixed the non-bulk changeset path to strip private arguments from user-supplied parameter maps, but the bulk destroy and bulk update paths were not covered.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eAsh.Actions.Destroy.Bulk.base_changeset/5\u003c/code\u003e and \u003ccode\u003eAsh.Actions.Update.Bulk.base_changeset/5\u003c/code\u003e match every key in the caller-supplied parameter map against all of the action\u0027s arguments with no \u003ccode\u003epublic?\u003c/code\u003e check, then apply the matches to the base changeset. A caller who can submit parameters to a bulk destroy or bulk update action (for example through AshJsonApi, AshGraphql, or a controller that forwards request parameters to \u003ccode\u003eAsh.bulk_destroy/4\u003c/code\u003e or \u003ccode\u003eAsh.bulk_update/4\u003c/code\u003e) can therefore set any private argument of that action, including one referenced by an \u003ccode\u003earg(...)\u003c/code\u003e template in the action\u0027s changes or validations. Depending on how the application uses the argument (for example an \u003ccode\u003eacting_user_id\u003c/code\u003e driving authorization or record ownership, or audit metadata), this can lead to an integrity violation or privilege escalation.\u003c/p\u003e\n\u003cp\u003eThe fix requires \u003ccode\u003epublic?\u003c/code\u003e in the argument matching on both bulk paths; private arguments remain settable server-side via the \u003ccode\u003e:private_arguments\u003c/code\u003e option.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash: from 2.17.15 before 3.33.11.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash allows a user to set the value of a private action argument on the bulk destroy and bulk update paths.\n\nAction arguments declared with `public?: false` are meant to be set only by trusted server-side code (for example via `Ash.Changeset.set_private_argument/3`) and must not be settable from end-user input. CVE-2026-55736 fixed the non-bulk changeset path to strip private arguments from user-supplied parameter maps, but the bulk destroy and bulk update paths were not covered.\n\n`Ash.Actions.Destroy.Bulk.base_changeset/5` and `Ash.Actions.Update.Bulk.base_changeset/5` match every key in the caller-supplied parameter map against all of the action\u0027s arguments with no `public?` check, then apply the matches to the base changeset. A caller who can submit parameters to a bulk destroy or bulk update action (for example through AshJsonApi, AshGraphql, or a controller that forwards request parameters to `Ash.bulk_destroy/4` or `Ash.bulk_update/4`) can therefore set any private argument of that action, including one referenced by an `arg(...)` template in the action\u0027s changes or validations. Depending on how the application uses the argument (for example an `acting_user_id` driving authorization or record ownership, or audit metadata), this can lead to an integrity violation or privilege escalation.\n\nThe fix requires `public?` in the argument matching on both bulk paths; private arguments remain settable server-side via the `:private_arguments` option.\n\nThis issue affects ash: from 2.17.15 before 3.33.11."
}
],
"value": "Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash allows a user to set the value of a private action argument on the bulk destroy and bulk update paths.\n\nAction arguments declared with public?: false are meant to be set only by trusted server-side code (for example via Ash.Changeset.set_private_argument/3) and must not be settable from end-user input. CVE-2026-55736 fixed the non-bulk changeset path to strip private arguments from user-supplied parameter maps, but the bulk destroy and bulk update paths were not covered.\n\nAsh.Actions.Destroy.Bulk.base_changeset/5 and Ash.Actions.Update.Bulk.base_changeset/5 match every key in the caller-supplied parameter map against all of the action\u0027s arguments with no public? check, then apply the matches to the base changeset. A caller who can submit parameters to a bulk destroy or bulk update action (for example through AshJsonApi, AshGraphql, or a controller that forwards request parameters to Ash.bulk_destroy/4 or Ash.bulk_update/4) can therefore set any private argument of that action, including one referenced by an arg(...) template in the action\u0027s changes or validations. Depending on how the application uses the argument (for example an acting_user_id driving authorization or record ownership, or audit metadata), this can lead to an integrity violation or privilege escalation.\n\nThe fix requires public? in the argument matching on both bulk paths; private arguments remain settable server-side via the :private_arguments option.\n\nThis issue affects ash: from 2.17.15 before 3.33.11."
}
],
"impacts": [
{
"capecId": "CAPEC-77",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-77 Manipulating User-Controlled Variables"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-915",
"description": "CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T07:08:55.191Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "GHSA-c2p4-p7q6-hr2j",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-c2p4-p7q6-hr2j"
},
{
"name": "EEF CNA record for CVE-2026-93477",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-93477.html"
},
{
"name": "OSV record EEF-CVE-2026-93477",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-93477"
},
{
"name": "Introducing commit 8c17434 in ash-project/ash",
"tags": [
"related"
],
"url": "https://github.com/ash-project/ash/commit/8c17434803b2e91de522bdfbd0ca918e5d5898df"
},
{
"name": "Fix commit 6b7ac53 in ash-project/ash",
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash/commit/6b7ac53a0a2532291eb940d7beaf0fbb2da6fc4f"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Private action arguments can be set by user input on the bulk destroy and bulk update paths in Ash"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-93477",
"datePublished": "2026-09-25T07:08:55.191Z",
"dateReserved": "2026-09-19T16:00:02.004Z",
"dateUpdated": "2026-09-25T13:26:42.369Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86338 (GCVE-0-2026-86338)
Vulnerability from cvelistv5 – Published: 2026-09-16 08:28 – Updated: 2026-09-16 14:49
VLAI
EPSS
VEX
Title
Ash field policies do not filter-nil forbidden calculations and aggregates, enabling an information-disclosure oracle
Summary
Ash field_policies are documented to protect against filter-based information disclosure: when a field the actor may not see is referenced in a filter, it is replaced with an expression that evaluates to nil, so a filter cannot be used as a yes/no oracle to read a value the actor cannot see.
This nilling was applied to attributes but not to calculations or aggregates. A user-supplied filter reference to a calculation or aggregate carries an Ash.Query.Calculation / Ash.Query.Aggregate struct, which the authorizer's reference replacement did not match (it only matched the Ash.Resource.* structs), so the filter ran against the real value.
As a result, an actor whose field policies forbid a calculation or aggregate can still filter by it (for example filter(secret_calc == "x") or filter(comment_count == n)) and learn the value from whether rows match — an oracle that recovers field-policy-protected values one probe at a time. Filtering is commonly exposed to lower-privileged actors (for example via AshGraphql or AshJsonApi filter arguments), which is exactly the surface field policies are meant to protect.
The fix routes filter references to calculations and aggregates through the same field-policy nilling as attributes.
This issue affects ash: from 2.11.0-rc.0 before 3.33.4.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 14:49 UTC
CWE
- CWE-1220 - Insufficient Granularity of Access Control
Assigner
References
5 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash |
Affected:
2.11.0-rc.0 , < 3.33.4
(semver)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
|
| ash-project | ash |
Affected:
0b6d93c7c4637280b46ae66ea1d2eaf013701238 , < b3d4503241f3deacb5ceb955e10a4fa927da0f67
(git)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86338",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T14:49:09.195379Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T14:49:17.203Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Policy.Authorizer\u0027"
],
"packageName": "ash",
"packageURL": "pkg:hex/ash",
"product": "ash",
"programFiles": [
"lib/ash/policy/authorizer/authorizer.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Policy.Authorizer\u0027:do_replace_ref/2"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "3.33.4",
"status": "affected",
"version": "2.11.0-rc.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Policy.Authorizer\u0027"
],
"packageName": "ash-project/ash",
"packageURL": "pkg:github/ash-project/ash",
"product": "ash",
"programFiles": [
"lib/ash/policy/authorizer/authorizer.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Policy.Authorizer\u0027:do_replace_ref/2"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "b3d4503241f3deacb5ceb955e10a4fa927da0f67",
"status": "affected",
"version": "0b6d93c7c4637280b46ae66ea1d2eaf013701238",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eReachable only when an application uses \u003ccode\u003eAsh.Policy.Authorizer\u003c/code\u003e field policies to restrict a calculation or aggregate, and exposes filtering on it to an actor who is denied that field (for example an authenticated user filtering through AshGraphql or AshJsonApi).\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Reachable only when an application uses `Ash.Policy.Authorizer` field policies to restrict a calculation or aggregate, and exposes filtering on it to an actor who is denied that field (for example an authenticated user filtering through AshGraphql or AshJsonApi)."
}
],
"value": "Reachable only when an application uses Ash.Policy.Authorizer field policies to restrict a calculation or aggregate, and exposes filtering on it to an actor who is denied that field (for example an authenticated user filtering through AshGraphql or AshJsonApi)."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.33.4",
"versionStartIncluding": "2.11.0-rc.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Jesse Williams"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "finder",
"value": "Jesse Williams"
}
],
"dateAssigned": "2026-09-15T23:33:34.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAsh \u003ccode\u003efield_policies\u003c/code\u003e are documented to protect against filter-based information disclosure: when a field the actor may not see is referenced in a filter, it is replaced with an expression that evaluates to \u003ccode\u003enil\u003c/code\u003e, so a filter cannot be used as a yes/no oracle to read a value the actor cannot see.\u003c/p\u003e\n\u003cp\u003eThis nilling was applied to attributes but not to calculations or aggregates. A user-supplied filter reference to a calculation or aggregate carries an \u003ccode\u003eAsh.Query.Calculation\u003c/code\u003e / \u003ccode\u003eAsh.Query.Aggregate\u003c/code\u003e struct, which the authorizer\u0027s reference replacement did not match (it only matched the \u003ccode\u003eAsh.Resource.*\u003c/code\u003e structs), so the filter ran against the real value.\u003c/p\u003e\n\u003cp\u003eAs a result, an actor whose field policies forbid a calculation or aggregate can still filter by it (for example \u003ccode\u003efilter(secret_calc == \"x\")\u003c/code\u003e or \u003ccode\u003efilter(comment_count == n)\u003c/code\u003e) and learn the value from whether rows match \u2014 an oracle that recovers field-policy-protected values one probe at a time. Filtering is commonly exposed to lower-privileged actors (for example via AshGraphql or AshJsonApi filter arguments), which is exactly the surface field policies are meant to protect.\u003c/p\u003e\n\u003cp\u003eThe fix routes filter references to calculations and aggregates through the same field-policy nilling as attributes.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash: from 2.11.0-rc.0 before 3.33.4.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Ash `field_policies` are documented to protect against filter-based information disclosure: when a field the actor may not see is referenced in a filter, it is replaced with an expression that evaluates to `nil`, so a filter cannot be used as a yes/no oracle to read a value the actor cannot see.\n\nThis nilling was applied to attributes but not to calculations or aggregates. A user-supplied filter reference to a calculation or aggregate carries an `Ash.Query.Calculation` / `Ash.Query.Aggregate` struct, which the authorizer\u0027s reference replacement did not match (it only matched the `Ash.Resource.*` structs), so the filter ran against the real value.\n\nAs a result, an actor whose field policies forbid a calculation or aggregate can still filter by it (for example `filter(secret_calc == \"x\")` or `filter(comment_count == n)`) and learn the value from whether rows match \u2014 an oracle that recovers field-policy-protected values one probe at a time. Filtering is commonly exposed to lower-privileged actors (for example via AshGraphql or AshJsonApi filter arguments), which is exactly the surface field policies are meant to protect.\n\nThe fix routes filter references to calculations and aggregates through the same field-policy nilling as attributes.\n\nThis issue affects ash: from 2.11.0-rc.0 before 3.33.4."
}
],
"value": "Ash field_policies are documented to protect against filter-based information disclosure: when a field the actor may not see is referenced in a filter, it is replaced with an expression that evaluates to nil, so a filter cannot be used as a yes/no oracle to read a value the actor cannot see.\n\nThis nilling was applied to attributes but not to calculations or aggregates. A user-supplied filter reference to a calculation or aggregate carries an Ash.Query.Calculation / Ash.Query.Aggregate struct, which the authorizer\u0027s reference replacement did not match (it only matched the Ash.Resource.* structs), so the filter ran against the real value.\n\nAs a result, an actor whose field policies forbid a calculation or aggregate can still filter by it (for example filter(secret_calc == \"x\") or filter(comment_count == n)) and learn the value from whether rows match \u2014 an oracle that recovers field-policy-protected values one probe at a time. Filtering is commonly exposed to lower-privileged actors (for example via AshGraphql or AshJsonApi filter arguments), which is exactly the surface field policies are meant to protect.\n\nThe fix routes filter references to calculations and aggregates through the same field-policy nilling as attributes.\n\nThis issue affects ash: from 2.11.0-rc.0 before 3.33.4."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1220",
"description": "CWE-1220 Insufficient Granularity of Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T08:28:44.114Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "GHSA-7qr8-wrvq-566q",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-7qr8-wrvq-566q"
},
{
"name": "EEF CNA record for CVE-2026-86338",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-86338.html"
},
{
"name": "OSV record EEF-CVE-2026-86338",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-86338"
},
{
"name": "Introducing commit 0b6d93c in ash-project/ash",
"tags": [
"related"
],
"url": "https://github.com/ash-project/ash/commit/0b6d93c7c4637280b46ae66ea1d2eaf013701238"
},
{
"name": "Fix commit b3d4503 in ash-project/ash",
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash/commit/b3d4503241f3deacb5ceb955e10a4fa927da0f67"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Ash field policies do not filter-nil forbidden calculations and aggregates, enabling an information-disclosure oracle"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-86338",
"datePublished": "2026-09-16T08:28:44.114Z",
"dateReserved": "2026-09-15T15:30:01.895Z",
"dateUpdated": "2026-09-16T14:49:17.203Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78216 (GCVE-0-2026-78216)
Vulnerability from cvelistv5 – Published: 2026-09-08 16:42 – Updated: 2026-09-08 17:27
VLAI
EPSS
VEX
Title
AshLua eval read operations can read field-policy-protected fields via aggregates
Summary
AshLua exposes Ash read actions to Lua scripts run through an eval action. A read call accepts an operation (list, min, max, first, sum, avg) that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value.
Ash field policies redact forbidden fields on returned records (replacing them with %Ash.ForbiddenField{}), but that redaction does not apply to aggregate values. A script could therefore read a field the calling actor's field policies forbid by requesting it as an aggregate instead of as a field. This includes fields that are public? true but restricted per-actor by a field policy, such as sensitive PII. The prior hardening only enforced the exposed-field allow-list (field visibility), which is a separate axis from per-actor field-policy authorization.
The fix authorizes the aggregated field against the resource's field policies, so aggregating over a field the actor may not see is refused or scoped to the rows where it is visible.
This issue affects ash_lua: from 0.1.0 before 0.2.2.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 17:26 UTC
CWE
- CWE-1220 - Insufficient Granularity of Access Control
Assigner
References
5 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_lua |
Affected:
0.1.0 , < 0.2.2
(semver)
cpe:2.3:a:ash-project:ash_lua:*:*:*:*:*:*:*:* |
|
| ash-project | ash_lua |
Affected:
8675e47cca81f36594083a7e63379bac9e123e72 , < 266a5dcc56d5015b6d316c10606169e753b07450
(git)
cpe:2.3:a:ash-project:ash_lua:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-78216",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T17:26:34.675766Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T17:27:08.856Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_lua:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshLua.Runtime\u0027"
],
"packageName": "ash_lua",
"packageURL": "pkg:hex/ash_lua",
"product": "ash_lua",
"programFiles": [
"lib/ash_lua/runtime.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshLua.Runtime\u0027:run_read_operation/5"
}
],
"repo": "https://github.com/ash-project/ash_lua",
"vendor": "ash-project",
"versions": [
{
"lessThan": "0.2.2",
"status": "affected",
"version": "0.1.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_lua:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshLua.Runtime\u0027"
],
"packageName": "ash-project/ash_lua",
"packageURL": "pkg:github/ash-project/ash_lua",
"product": "ash_lua",
"programFiles": [
"lib/ash_lua/runtime.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshLua.Runtime\u0027:run_read_operation/5"
}
],
"repo": "https://github.com/ash-project/ash_lua",
"vendor": "ash-project",
"versions": [
{
"lessThan": "266a5dcc56d5015b6d316c10606169e753b07450",
"status": "affected",
"version": "8675e47cca81f36594083a7e63379bac9e123e72",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eReachable only when an application exposes an AshLua \u003ccode\u003eeval\u003c/code\u003e action over a resource whose field policies restrict a field that the calling actor can still name as an operation aggregate (for example a \u003ccode\u003epublic? true\u003c/code\u003e but field-policy-protected attribute).\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Reachable only when an application exposes an AshLua `eval` action over a resource whose field policies restrict a field that the calling actor can still name as an operation aggregate (for example a `public? true` but field-policy-protected attribute)."
}
],
"value": "Reachable only when an application exposes an AshLua eval action over a resource whose field policies restrict a field that the calling actor can still name as an operation aggregate (for example a public? true but field-policy-protected attribute)."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_lua:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.2.2",
"versionStartIncluding": "0.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "finder",
"value": "Aaron Hong / Remedy"
}
],
"dateAssigned": "2026-09-08T15:43:48.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAshLua exposes Ash read actions to Lua scripts run through an \u003ccode\u003eeval\u003c/code\u003e action. A read call accepts an \u003ccode\u003eoperation\u003c/code\u003e (\u003ccode\u003elist\u003c/code\u003e, \u003ccode\u003emin\u003c/code\u003e, \u003ccode\u003emax\u003c/code\u003e, \u003ccode\u003efirst\u003c/code\u003e, \u003ccode\u003esum\u003c/code\u003e, \u003ccode\u003eavg\u003c/code\u003e) that builds an ad-hoc \u003ccode\u003eAsh.Query.Aggregate\u003c/code\u003e over a named field and returns its raw value.\u003c/p\u003e\n\u003cp\u003eAsh field policies redact forbidden fields on returned records (replacing them with \u003ccode\u003e%Ash.ForbiddenField{}\u003c/code\u003e), but that redaction does not apply to aggregate values. A script could therefore read a field the calling actor\u0027s field policies forbid by requesting it as an aggregate instead of as a field. This includes fields that are \u003ccode\u003epublic? true\u003c/code\u003e but restricted per-actor by a field policy, such as sensitive PII. The prior hardening only enforced the exposed-field allow-list (field visibility), which is a separate axis from per-actor field-policy authorization.\u003c/p\u003e\n\u003cp\u003eThe fix authorizes the aggregated field against the resource\u0027s field policies, so aggregating over a field the actor may not see is refused or scoped to the rows where it is visible.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_lua: from 0.1.0 before 0.2.2.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "AshLua exposes Ash read actions to Lua scripts run through an `eval` action. A read call accepts an `operation` (`list`, `min`, `max`, `first`, `sum`, `avg`) that builds an ad-hoc `Ash.Query.Aggregate` over a named field and returns its raw value.\n\nAsh field policies redact forbidden fields on returned records (replacing them with `%Ash.ForbiddenField{}`), but that redaction does not apply to aggregate values. A script could therefore read a field the calling actor\u0027s field policies forbid by requesting it as an aggregate instead of as a field. This includes fields that are `public? true` but restricted per-actor by a field policy, such as sensitive PII. The prior hardening only enforced the exposed-field allow-list (field visibility), which is a separate axis from per-actor field-policy authorization.\n\nThe fix authorizes the aggregated field against the resource\u0027s field policies, so aggregating over a field the actor may not see is refused or scoped to the rows where it is visible.\n\nThis issue affects ash_lua: from 0.1.0 before 0.2.2."
}
],
"value": "AshLua exposes Ash read actions to Lua scripts run through an eval action. A read call accepts an operation (list, min, max, first, sum, avg) that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value.\n\nAsh field policies redact forbidden fields on returned records (replacing them with %Ash.ForbiddenField{}), but that redaction does not apply to aggregate values. A script could therefore read a field the calling actor\u0027s field policies forbid by requesting it as an aggregate instead of as a field. This includes fields that are public? true but restricted per-actor by a field policy, such as sensitive PII. The prior hardening only enforced the exposed-field allow-list (field visibility), which is a separate axis from per-actor field-policy authorization.\n\nThe fix authorizes the aggregated field against the resource\u0027s field policies, so aggregating over a field the actor may not see is refused or scoped to the rows where it is visible.\n\nThis issue affects ash_lua: from 0.1.0 before 0.2.2."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1220",
"description": "CWE-1220 Insufficient Granularity of Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T16:42:20.908Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "GHSA-5whv-8rcp-x33j",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/ash-project/ash_lua/security/advisories/GHSA-5whv-8rcp-x33j"
},
{
"name": "EEF CNA record for CVE-2026-78216",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-78216.html"
},
{
"name": "OSV record EEF-CVE-2026-78216",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-78216"
},
{
"name": "Introducing commit 8675e47 in ash-project/ash_lua",
"tags": [
"related"
],
"url": "https://github.com/ash-project/ash_lua/commit/8675e47cca81f36594083a7e63379bac9e123e72"
},
{
"name": "Fix commit 266a5dc in ash-project/ash_lua",
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_lua/commit/266a5dcc56d5015b6d316c10606169e753b07450"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "AshLua eval read operations can read field-policy-protected fields via aggregates"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-78216",
"datePublished": "2026-09-08T16:42:20.908Z",
"dateReserved": "2026-08-31T00:45:02.446Z",
"dateUpdated": "2026-09-08T17:27:08.856Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78230 (GCVE-0-2026-78230)
Vulnerability from cvelistv5 – Published: 2026-09-08 16:41 – Updated: 2026-09-08 17:33
VLAI
EPSS
VEX
Title
AshAi aggregate tool can read field-policy-protected fields
Summary
AshAi exposes Ash read actions to language-model tool calls. The read tool accepts an aggregate result type (min, max, sum, avg) that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value.
Ash field policies redact forbidden fields on returned records (replacing them with %Ash.ForbiddenField{}), but that redaction does not apply to aggregate values. A tool caller could therefore read a field the calling actor's field policies forbid by requesting it as an aggregate; min/max in particular return an actual field value. This includes fields that are public? true but restricted per-actor by a field policy, such as sensitive PII. The tool's existing check only required the field to be public, which is a separate axis from per-actor field-policy authorization.
The fix authorizes the aggregated field against the resource's field policies, so aggregating over a field the actor may not see is refused or scoped to the rows where it is visible.
This issue affects ash_ai: from 0.1.0 before 1.0.3.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 17:33 UTC
CWE
- CWE-1220 - Insufficient Granularity of Access Control
Assigner
References
5 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_ai |
Affected:
0.1.0 , < 1.0.3
(semver)
cpe:2.3:a:ash-project:ash_ai:*:*:*:*:*:*:*:* |
|
| ash-project | ash_ai |
Affected:
2ba234b50946a3b8116190c8467f9f4dfa5edce7 , < 9c02de581625c342c9870a672830bff28c1d701e
(git)
cpe:2.3:a:ash-project:ash_ai:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-78230",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T17:33:49.017554Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T17:33:57.604Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_ai:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAi.Tool.Execution\u0027"
],
"packageName": "ash_ai",
"packageURL": "pkg:hex/ash_ai",
"product": "ash_ai",
"programFiles": [
"lib/ash_ai/tool/execution.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAi.Tool.Execution\u0027:execute_read/4"
}
],
"repo": "https://github.com/ash-project/ash_ai",
"vendor": "ash-project",
"versions": [
{
"lessThan": "1.0.3",
"status": "affected",
"version": "0.1.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_ai:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAi.Tool.Execution\u0027"
],
"packageName": "ash-project/ash_ai",
"packageURL": "pkg:github/ash-project/ash_ai",
"product": "ash_ai",
"programFiles": [
"lib/ash_ai/tool/execution.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAi.Tool.Execution\u0027:execute_read/4"
}
],
"repo": "https://github.com/ash-project/ash_ai",
"vendor": "ash-project",
"versions": [
{
"lessThan": "9c02de581625c342c9870a672830bff28c1d701e",
"status": "affected",
"version": "2ba234b50946a3b8116190c8467f9f4dfa5edce7",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eReachable only when an application exposes an AshAi read tool over a resource whose field policies restrict a field that the calling actor can still name as an aggregate (for example a \u003ccode\u003epublic? true\u003c/code\u003e but field-policy-protected attribute).\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Reachable only when an application exposes an AshAi read tool over a resource whose field policies restrict a field that the calling actor can still name as an aggregate (for example a `public? true` but field-policy-protected attribute)."
}
],
"value": "Reachable only when an application exposes an AshAi read tool over a resource whose field policies restrict a field that the calling actor can still name as an aggregate (for example a public? true but field-policy-protected attribute)."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_ai:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.0.3",
"versionStartIncluding": "0.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "finder",
"value": "Aaron Hong / Remedy"
}
],
"dateAssigned": "2026-09-08T15:44:25.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAshAi exposes Ash read actions to language-model tool calls. The read tool accepts an aggregate result type (\u003ccode\u003emin\u003c/code\u003e, \u003ccode\u003emax\u003c/code\u003e, \u003ccode\u003esum\u003c/code\u003e, \u003ccode\u003eavg\u003c/code\u003e) that builds an ad-hoc \u003ccode\u003eAsh.Query.Aggregate\u003c/code\u003e over a named field and returns its raw value.\u003c/p\u003e\n\u003cp\u003eAsh field policies redact forbidden fields on returned records (replacing them with \u003ccode\u003e%Ash.ForbiddenField{}\u003c/code\u003e), but that redaction does not apply to aggregate values. A tool caller could therefore read a field the calling actor\u0027s field policies forbid by requesting it as an aggregate; \u003ccode\u003emin\u003c/code\u003e/\u003ccode\u003emax\u003c/code\u003e in particular return an actual field value. This includes fields that are \u003ccode\u003epublic? true\u003c/code\u003e but restricted per-actor by a field policy, such as sensitive PII. The tool\u0027s existing check only required the field to be public, which is a separate axis from per-actor field-policy authorization.\u003c/p\u003e\n\u003cp\u003eThe fix authorizes the aggregated field against the resource\u0027s field policies, so aggregating over a field the actor may not see is refused or scoped to the rows where it is visible.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_ai: from 0.1.0 before 1.0.3.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "AshAi exposes Ash read actions to language-model tool calls. The read tool accepts an aggregate result type (`min`, `max`, `sum`, `avg`) that builds an ad-hoc `Ash.Query.Aggregate` over a named field and returns its raw value.\n\nAsh field policies redact forbidden fields on returned records (replacing them with `%Ash.ForbiddenField{}`), but that redaction does not apply to aggregate values. A tool caller could therefore read a field the calling actor\u0027s field policies forbid by requesting it as an aggregate; `min`/`max` in particular return an actual field value. This includes fields that are `public? true` but restricted per-actor by a field policy, such as sensitive PII. The tool\u0027s existing check only required the field to be public, which is a separate axis from per-actor field-policy authorization.\n\nThe fix authorizes the aggregated field against the resource\u0027s field policies, so aggregating over a field the actor may not see is refused or scoped to the rows where it is visible.\n\nThis issue affects ash_ai: from 0.1.0 before 1.0.3."
}
],
"value": "AshAi exposes Ash read actions to language-model tool calls. The read tool accepts an aggregate result type (min, max, sum, avg) that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value.\n\nAsh field policies redact forbidden fields on returned records (replacing them with %Ash.ForbiddenField{}), but that redaction does not apply to aggregate values. A tool caller could therefore read a field the calling actor\u0027s field policies forbid by requesting it as an aggregate; min/max in particular return an actual field value. This includes fields that are public? true but restricted per-actor by a field policy, such as sensitive PII. The tool\u0027s existing check only required the field to be public, which is a separate axis from per-actor field-policy authorization.\n\nThe fix authorizes the aggregated field against the resource\u0027s field policies, so aggregating over a field the actor may not see is refused or scoped to the rows where it is visible.\n\nThis issue affects ash_ai: from 0.1.0 before 1.0.3."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1220",
"description": "CWE-1220 Insufficient Granularity of Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T16:41:45.975Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "GHSA-v5rw-36x5-r5vx",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/ash-project/ash_ai/security/advisories/GHSA-v5rw-36x5-r5vx"
},
{
"name": "EEF CNA record for CVE-2026-78230",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-78230.html"
},
{
"name": "OSV record EEF-CVE-2026-78230",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-78230"
},
{
"name": "Introducing commit 2ba234b in ash-project/ash_ai",
"tags": [
"related"
],
"url": "https://github.com/ash-project/ash_ai/commit/2ba234b50946a3b8116190c8467f9f4dfa5edce7"
},
{
"name": "Fix commit 9c02de5 in ash-project/ash_ai",
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_ai/commit/9c02de581625c342c9870a672830bff28c1d701e"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "AshAi aggregate tool can read field-policy-protected fields"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-78230",
"datePublished": "2026-09-08T16:41:45.975Z",
"dateReserved": "2026-08-31T00:45:02.439Z",
"dateUpdated": "2026-09-08T17:33:57.604Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82710 (GCVE-0-2026-82710)
Vulnerability from cvelistv5 – Published: 2026-09-08 00:23 – Updated: 2026-09-08 14:45
VLAI
EPSS
VEX
Title
Terminal escape sequence injection in mix usage_rules.search_docs via package documentation metadata
Summary
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project usage_rules allows a malicious package publisher to inject terminal control sequences into the output of mix usage_rules.search_docs.
mix usage_rules.search_docs searches Hex documentation through search.hexdocs.pm, which indexes the documentation of every published package, and prints the matching results (title, package, type, doc reference, and highlighted snippets) to the terminal. The formatter in Mix.Tasks.UsageRules.SearchDocs interpolated those publisher-controlled fields verbatim, neutralizing no terminal control characters; the only transform it applied adds escape sequences rather than removing them. A malicious package can embed ANSI terminal escape sequences (cursor movement, line erase, carriage returns, OSC 52 clipboard writes) in its indexed documentation, so when a developer runs a search that surfaces those docs the sequences reach the terminal unchanged — forging the displayed hexdocs URL or a suggested command, hiding text, or writing to the clipboard. No authentication or privileged position is required; only publishing a package.
This issue affects usage_rules: from 0.1.18 before 1.2.8.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 14:45 UTC
CWE
- CWE-150 - Improper Neutralization of Escape, Meta, or Control Sequences
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/usage_rules/securi… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82710.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82710 | related |
| https://github.com/ash-project/usage_rules/commit… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | usage_rules |
Affected:
0.1.18 , < 1.2.8
(semver)
cpe:2.3:a:ash-project:usage_rules:*:*:*:*:*:*:*:* |
|
| ash-project | usage_rules |
Affected:
2da7a99536041d63ec1f391d019565789a59595f , < 3b8ebb4117d3272bbd436e6c2432113ba6685dbb
(git)
cpe:2.3:a:ash-project:usage_rules:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82710",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T14:45:15.853850Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T14:45:23.177Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:usage_rules:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Mix.Tasks.UsageRules.SearchDocs\u0027"
],
"packageName": "usage_rules",
"packageURL": "pkg:hex/usage_rules",
"product": "usage_rules",
"programFiles": [
"lib/mix/tasks/usage_rules.search_docs.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Mix.Tasks.UsageRules.SearchDocs\u0027:format_search_result_markdown/4"
}
],
"repo": "https://github.com/ash-project/usage_rules",
"vendor": "ash-project",
"versions": [
{
"lessThan": "1.2.8",
"status": "affected",
"version": "0.1.18",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:usage_rules:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Mix.Tasks.UsageRules.SearchDocs\u0027"
],
"packageName": "ash-project/usage_rules",
"packageURL": "pkg:github/ash-project/usage_rules",
"product": "usage_rules",
"programFiles": [
"lib/mix/tasks/usage_rules.search_docs.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Mix.Tasks.UsageRules.SearchDocs\u0027:format_search_result_markdown/4"
}
],
"repo": "https://github.com/ash-project/usage_rules",
"vendor": "ash-project",
"versions": [
{
"lessThan": "3b8ebb4117d3272bbd436e6c2432113ba6685dbb",
"status": "affected",
"version": "2da7a99536041d63ec1f391d019565789a59595f",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eReachable only when a developer runs \u003ccode\u003emix usage_rules.search_docs\u003c/code\u003e in a terminal emulator that interprets ANSI escape sequences and the results include documentation from an attacker-published package (for example a broad \u003ccode\u003e--everywhere\u003c/code\u003e search).\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Reachable only when a developer runs `mix usage_rules.search_docs` in a terminal emulator that interprets ANSI escape sequences and the results include documentation from an attacker-published package (for example a broad `--everywhere` search)."
}
],
"value": "Reachable only when a developer runs mix usage_rules.search_docs in a terminal emulator that interprets ANSI escape sequences and the results include documentation from an attacker-published package (for example a broad --everywhere search)."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:usage_rules:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.2.8",
"versionStartIncluding": "0.1.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project usage_rules allows a malicious package publisher to inject terminal control sequences into the output of \u003ccode\u003emix usage_rules.search_docs\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003emix usage_rules.search_docs\u003c/code\u003e searches Hex documentation through \u003ccode\u003esearch.hexdocs.pm\u003c/code\u003e, which indexes the documentation of every published package, and prints the matching results (title, package, type, doc reference, and highlighted snippets) to the terminal. The formatter in \u003ccode\u003eMix.Tasks.UsageRules.SearchDocs\u003c/code\u003e interpolated those publisher-controlled fields verbatim, neutralizing no terminal control characters; the only transform it applied adds escape sequences rather than removing them. A malicious package can embed ANSI terminal escape sequences (cursor movement, line erase, carriage returns, OSC 52 clipboard writes) in its indexed documentation, so when a developer runs a search that surfaces those docs the sequences reach the terminal unchanged \u2014 forging the displayed hexdocs URL or a suggested command, hiding text, or writing to the clipboard. No authentication or privileged position is required; only publishing a package.\u003c/p\u003e\n\u003cp\u003eThis issue affects usage_rules: from 0.1.18 before 1.2.8.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project usage_rules allows a malicious package publisher to inject terminal control sequences into the output of `mix usage_rules.search_docs`.\n\n`mix usage_rules.search_docs` searches Hex documentation through `search.hexdocs.pm`, which indexes the documentation of every published package, and prints the matching results (title, package, type, doc reference, and highlighted snippets) to the terminal. The formatter in `Mix.Tasks.UsageRules.SearchDocs` interpolated those publisher-controlled fields verbatim, neutralizing no terminal control characters; the only transform it applied adds escape sequences rather than removing them. A malicious package can embed ANSI terminal escape sequences (cursor movement, line erase, carriage returns, OSC 52 clipboard writes) in its indexed documentation, so when a developer runs a search that surfaces those docs the sequences reach the terminal unchanged \u2014 forging the displayed hexdocs URL or a suggested command, hiding text, or writing to the clipboard. No authentication or privileged position is required; only publishing a package.\n\nThis issue affects usage_rules: from 0.1.18 before 1.2.8."
}
],
"value": "Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project usage_rules allows a malicious package publisher to inject terminal control sequences into the output of mix usage_rules.search_docs.\n\nmix usage_rules.search_docs searches Hex documentation through search.hexdocs.pm, which indexes the documentation of every published package, and prints the matching results (title, package, type, doc reference, and highlighted snippets) to the terminal. The formatter in Mix.Tasks.UsageRules.SearchDocs interpolated those publisher-controlled fields verbatim, neutralizing no terminal control characters; the only transform it applied adds escape sequences rather than removing them. A malicious package can embed ANSI terminal escape sequences (cursor movement, line erase, carriage returns, OSC 52 clipboard writes) in its indexed documentation, so when a developer runs a search that surfaces those docs the sequences reach the terminal unchanged \u2014 forging the displayed hexdocs URL or a suggested command, hiding text, or writing to the clipboard. No authentication or privileged position is required; only publishing a package.\n\nThis issue affects usage_rules: from 0.1.18 before 1.2.8."
}
],
"impacts": [
{
"capecId": "CAPEC-93",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-93 Log Injection-Tampering-Forging"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-150",
"description": "CWE-150 Improper Neutralization of Escape, Meta, or Control Sequences",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T00:23:36.912Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/usage_rules/security/advisories/GHSA-j59f-776f-23hp"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82710.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82710"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/usage_rules/commit/3b8ebb4117d3272bbd436e6c2432113ba6685dbb"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Terminal escape sequence injection in mix usage_rules.search_docs via package documentation metadata"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82710",
"datePublished": "2026-09-08T00:23:36.912Z",
"dateReserved": "2026-09-07T20:30:01.990Z",
"dateUpdated": "2026-09-08T14:45:23.177Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82584 (GCVE-0-2026-82584)
Vulnerability from cvelistv5 – Published: 2026-09-07 22:54 – Updated: 2026-09-08 14:44
VLAI
EPSS
VEX
Title
Terminal escape sequence injection in the mix igniter.install confirmation prompt via package metadata
Summary
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project igniter allows a malicious package publisher to forge the mix igniter.install confirmation prompt.
mix igniter.install prints a confirmation panel (an anti-typosquatting safeguard) listing a package's hex metadata before adding it. The panel builder in Igniter.Project.Deps wrote publisher-controlled fields (meta.description, owner usernames, requirement names, version) to the terminal with only newlines stripped. A malicious or typosquatted package can embed ANSI terminal escape sequences (cursor movement, line erase, carriage returns) in its metadata to overwrite the panel, forging trusted author names and download counts while concealing the real ones, so a developer relying on the panel to vet the package is deceived into approving a malicious dependency.
This issue affects igniter: from 0.8.1 before 0.8.4.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 14:44 UTC
CWE
- CWE-150 - Improper Neutralization of Escape, Meta, or Control Sequences
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/igniter/security/a… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82584.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82584 | related |
| https://github.com/ash-project/igniter/commit/d49… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | igniter |
Affected:
0.8.1 , < 0.8.4
(semver)
cpe:2.3:a:ash-project:igniter:*:*:*:*:*:*:*:* |
|
| ash-project | igniter |
Affected:
d26d9b3a8348661813617606076315075d32663b , < d492b1aa33f8fb0dacc0afa41b703fb922d42816
(git)
cpe:2.3:a:ash-project:igniter:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82584",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T14:44:50.539017Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T14:44:59.110Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:igniter:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Igniter.Project.Deps\u0027"
],
"packageName": "igniter",
"packageURL": "pkg:hex/igniter",
"product": "igniter",
"programFiles": [
"lib/igniter/project/deps.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Igniter.Project.Deps\u0027:determine_dep_type_and_version!/2"
}
],
"repo": "https://github.com/ash-project/igniter",
"vendor": "ash-project",
"versions": [
{
"lessThan": "0.8.4",
"status": "affected",
"version": "0.8.1",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:igniter:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Igniter.Project.Deps\u0027"
],
"packageName": "ash-project/igniter",
"packageURL": "pkg:github/ash-project/igniter",
"product": "igniter",
"programFiles": [
"lib/igniter/project/deps.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Igniter.Project.Deps\u0027:determine_dep_type_and_version!/2"
}
],
"repo": "https://github.com/ash-project/igniter",
"vendor": "ash-project",
"versions": [
{
"lessThan": "d492b1aa33f8fb0dacc0afa41b703fb922d42816",
"status": "affected",
"version": "d26d9b3a8348661813617606076315075d32663b",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eReachable only when a developer runs \u003ccode\u003emix igniter.install\u003c/code\u003e against an untrusted or misspelled package name in a terminal emulator that interprets ANSI escape sequences.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Reachable only when a developer runs `mix igniter.install` against an untrusted or misspelled package name in a terminal emulator that interprets ANSI escape sequences."
}
],
"value": "Reachable only when a developer runs mix igniter.install against an untrusted or misspelled package name in a terminal emulator that interprets ANSI escape sequences."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:igniter:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.8.4",
"versionStartIncluding": "0.8.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project igniter allows a malicious package publisher to forge the \u003ccode\u003emix igniter.install\u003c/code\u003e confirmation prompt.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003emix igniter.install\u003c/code\u003e prints a confirmation panel (an anti-typosquatting safeguard) listing a package\u0027s hex metadata before adding it. The panel builder in \u003ccode\u003eIgniter.Project.Deps\u003c/code\u003e wrote publisher-controlled fields (\u003ccode\u003emeta.description\u003c/code\u003e, owner usernames, requirement names, version) to the terminal with only newlines stripped. A malicious or typosquatted package can embed ANSI terminal escape sequences (cursor movement, line erase, carriage returns) in its metadata to overwrite the panel, forging trusted author names and download counts while concealing the real ones, so a developer relying on the panel to vet the package is deceived into approving a malicious dependency.\u003c/p\u003e\n\u003cp\u003eThis issue affects igniter: from 0.8.1 before 0.8.4.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project igniter allows a malicious package publisher to forge the `mix igniter.install` confirmation prompt.\n\n`mix igniter.install` prints a confirmation panel (an anti-typosquatting safeguard) listing a package\u0027s hex metadata before adding it. The panel builder in `Igniter.Project.Deps` wrote publisher-controlled fields (`meta.description`, owner usernames, requirement names, version) to the terminal with only newlines stripped. A malicious or typosquatted package can embed ANSI terminal escape sequences (cursor movement, line erase, carriage returns) in its metadata to overwrite the panel, forging trusted author names and download counts while concealing the real ones, so a developer relying on the panel to vet the package is deceived into approving a malicious dependency.\n\nThis issue affects igniter: from 0.8.1 before 0.8.4."
}
],
"value": "Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project igniter allows a malicious package publisher to forge the mix igniter.install confirmation prompt.\n\nmix igniter.install prints a confirmation panel (an anti-typosquatting safeguard) listing a package\u0027s hex metadata before adding it. The panel builder in Igniter.Project.Deps wrote publisher-controlled fields (meta.description, owner usernames, requirement names, version) to the terminal with only newlines stripped. A malicious or typosquatted package can embed ANSI terminal escape sequences (cursor movement, line erase, carriage returns) in its metadata to overwrite the panel, forging trusted author names and download counts while concealing the real ones, so a developer relying on the panel to vet the package is deceived into approving a malicious dependency.\n\nThis issue affects igniter: from 0.8.1 before 0.8.4."
}
],
"impacts": [
{
"capecId": "CAPEC-93",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-93 Log Injection-Tampering-Forging"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-150",
"description": "CWE-150 Improper Neutralization of Escape, Meta, or Control Sequences",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T22:54:48.222Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/igniter/security/advisories/GHSA-cj7w-j579-gc42"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82584.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82584"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/igniter/commit/d492b1aa33f8fb0dacc0afa41b703fb922d42816"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Terminal escape sequence injection in the mix igniter.install confirmation prompt via package metadata"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82584",
"datePublished": "2026-09-07T22:54:48.222Z",
"dateReserved": "2026-09-07T21:00:01.988Z",
"dateUpdated": "2026-09-08T14:44:59.110Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82586 (GCVE-0-2026-82586)
Vulnerability from cvelistv5 – Published: 2026-09-07 22:34 – Updated: 2026-09-08 14:44
VLAI
EPSS
VEX
Title
AshLua read operation aggregate bypasses the exposed-field allow-list, exposing private attributes
Summary
Improper Protection of Alternate Path vulnerability in ash-project ash_lua allows a user-supplied Lua script to read attributes that are not on the exposed-field allow-list.
AshLua exposes Ash resources to Lua scripts, gated by a manifest declaring which fields are exposed. The read action's operation aggregate path in AshLua.Runtime took the field name straight from the Lua call and resolved it with only String.to_existing_atom and Ash.Query.Aggregate.new!, neither of which consults the exposed-field allow-list the normal fields path enforces. A script can therefore read the value of any attribute of any record the actor may read, including private sensitive?: true columns, via resource.read({ operation = {"list", "hashed_password"} }); min and max give a value oracle. Anyone able to submit or influence a Lua script can reach this.
This issue affects ash_lua: from 0.1.0 before 0.2.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 14:44 UTC
CWE
- CWE-424 - Improper Protection of Alternate Path
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash_lua/security/a… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82586.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82586 | related |
| https://github.com/ash-project/ash_lua/commit/c0d… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_lua |
Affected:
0.1.0 , < 0.2.1
(semver)
cpe:2.3:a:ash-project:ash_lua:*:*:*:*:*:*:*:* |
|
| ash-project | ash_lua |
Affected:
8675e47cca81f36594083a7e63379bac9e123e72 , < c0dfcd9494766d548178c37df0bd01cff378e1c7
(git)
cpe:2.3:a:ash-project:ash_lua:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82586",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T14:44:32.288129Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T14:44:37.935Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_lua:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshLua.Runtime\u0027"
],
"packageName": "ash_lua",
"packageURL": "pkg:hex/ash_lua",
"product": "ash_lua",
"programFiles": [
"lib/ash_lua/runtime.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshLua.Runtime\u0027:eval!/2"
}
],
"repo": "https://github.com/ash-project/ash_lua",
"vendor": "ash-project",
"versions": [
{
"lessThan": "0.2.1",
"status": "affected",
"version": "0.1.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_lua:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshLua.Runtime\u0027"
],
"packageName": "ash-project/ash_lua",
"packageURL": "pkg:github/ash-project/ash_lua",
"product": "ash_lua",
"programFiles": [
"lib/ash_lua/runtime.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshLua.Runtime\u0027:eval!/2"
}
],
"repo": "https://github.com/ash-project/ash_lua",
"vendor": "ash-project",
"versions": [
{
"lessThan": "c0dfcd9494766d548178c37df0bd01cff378e1c7",
"status": "affected",
"version": "8675e47cca81f36594083a7e63379bac9e123e72",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eReachable only when an application exposes AshLua scripting (the \u003ccode\u003eAshLua.Resource\u003c/code\u003e / \u003ccode\u003eAshLua.Domain\u003c/code\u003e extensions) to callers who can submit or influence Lua scripts, and the exposed resource has attributes that are not on the exposed-field surface.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Reachable only when an application exposes AshLua scripting (the `AshLua.Resource` / `AshLua.Domain` extensions) to callers who can submit or influence Lua scripts, and the exposed resource has attributes that are not on the exposed-field surface."
}
],
"value": "Reachable only when an application exposes AshLua scripting (the AshLua.Resource / AshLua.Domain extensions) to callers who can submit or influence Lua scripts, and the exposed resource has attributes that are not on the exposed-field surface."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_lua:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.2.1",
"versionStartIncluding": "0.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Protection of Alternate Path vulnerability in ash-project ash_lua allows a user-supplied Lua script to read attributes that are not on the exposed-field allow-list.\u003c/p\u003e\n\u003cp\u003eAshLua exposes Ash resources to Lua scripts, gated by a manifest declaring which fields are exposed. The \u003ccode\u003eread\u003c/code\u003e action\u0027s \u003ccode\u003eoperation\u003c/code\u003e aggregate path in \u003ccode\u003eAshLua.Runtime\u003c/code\u003e took the field name straight from the Lua call and resolved it with only \u003ccode\u003eString.to_existing_atom\u003c/code\u003e and \u003ccode\u003eAsh.Query.Aggregate.new!\u003c/code\u003e, neither of which consults the exposed-field allow-list the normal \u003ccode\u003efields\u003c/code\u003e path enforces. A script can therefore read the value of any attribute of any record the actor may read, including private \u003ccode\u003esensitive?: true\u003c/code\u003e columns, via \u003ccode\u003eresource.read({ operation = {\"list\", \"hashed_password\"} })\u003c/code\u003e; \u003ccode\u003emin\u003c/code\u003e and \u003ccode\u003emax\u003c/code\u003e give a value oracle. Anyone able to submit or influence a Lua script can reach this.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_lua: from 0.1.0 before 0.2.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Improper Protection of Alternate Path vulnerability in ash-project ash_lua allows a user-supplied Lua script to read attributes that are not on the exposed-field allow-list.\n\nAshLua exposes Ash resources to Lua scripts, gated by a manifest declaring which fields are exposed. The `read` action\u0027s `operation` aggregate path in `AshLua.Runtime` took the field name straight from the Lua call and resolved it with only `String.to_existing_atom` and `Ash.Query.Aggregate.new!`, neither of which consults the exposed-field allow-list the normal `fields` path enforces. A script can therefore read the value of any attribute of any record the actor may read, including private `sensitive?: true` columns, via `resource.read({ operation = {\"list\", \"hashed_password\"} })`; `min` and `max` give a value oracle. Anyone able to submit or influence a Lua script can reach this.\n\nThis issue affects ash_lua: from 0.1.0 before 0.2.1."
}
],
"value": "Improper Protection of Alternate Path vulnerability in ash-project ash_lua allows a user-supplied Lua script to read attributes that are not on the exposed-field allow-list.\n\nAshLua exposes Ash resources to Lua scripts, gated by a manifest declaring which fields are exposed. The read action\u0027s operation aggregate path in AshLua.Runtime took the field name straight from the Lua call and resolved it with only String.to_existing_atom and Ash.Query.Aggregate.new!, neither of which consults the exposed-field allow-list the normal fields path enforces. A script can therefore read the value of any attribute of any record the actor may read, including private sensitive?: true columns, via resource.read({ operation = {\"list\", \"hashed_password\"} }); min and max give a value oracle. Anyone able to submit or influence a Lua script can reach this.\n\nThis issue affects ash_lua: from 0.1.0 before 0.2.1."
}
],
"impacts": [
{
"capecId": "CAPEC-554",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-554 Functionality Bypass"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-424",
"description": "CWE-424 Improper Protection of Alternate Path",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T22:34:14.837Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash_lua/security/advisories/GHSA-37jv-wc37-fhcw"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82586.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82586"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_lua/commit/c0dfcd9494766d548178c37df0bd01cff378e1c7"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "AshLua read operation aggregate bypasses the exposed-field allow-list, exposing private attributes"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82586",
"datePublished": "2026-09-07T22:34:14.837Z",
"dateReserved": "2026-09-07T19:30:01.631Z",
"dateUpdated": "2026-09-08T14:44:37.935Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-81638 (GCVE-0-2026-81638)
Vulnerability from cvelistv5 – Published: 2026-09-07 22:33 – Updated: 2026-09-08 14:44
VLAI
EPSS
VEX
Title
Non-canonical ULID spellings are accepted and alias to the same record in ash_double_entry
Summary
Improper Handling of Alternate Encoding vulnerability in ash-project ash_double_entry allows an attacker to submit several distinct string spellings of the same identifier.
AshDoubleEntry.ULID renders a 128-bit ULID as 26 Crockford base-32 characters, but the first character encodes only 3 bits, so canonical values are 0 to 7. decode/1 in lib/ulid.ex masks the first character to its low 3 bits and valid?/1 accepts all 32 characters in that position, so 0..., 8..., G... and R... decode to the identical 16-byte value and resolve to the same row. When the type is exposed as a public ID over an HTTP or API boundary, an attacker-supplied ID can be spelled differently from the record it actually reads or writes, desynchronizing or bypassing string-level checks such as idempotency and deduplication keys, deny-lists, audit correlation, or signatures computed over the submitted ID.
This issue affects ash_double_entry: from 0.1.0 before 1.0.19.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 14:44 UTC
CWE
- CWE-173 - Improper Handling of Alternate Encoding
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash_double_entry/s… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-81638.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-81638 | related |
| https://github.com/ash-project/ash_double_entry/c… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_double_entry |
Affected:
0.1.0 , < 1.0.19
(semver)
cpe:2.3:a:ash-project:ash_double_entry:*:*:*:*:*:*:*:* |
|
| ash-project | ash_double_entry |
Affected:
1e5f7ce8ff25f519c904731a29eb1258324e561a , < d3e688d300a581ae214b3ca7d95ef4de63fbb050
(git)
cpe:2.3:a:ash-project:ash_double_entry:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-81638",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T14:44:11.859893Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T14:44:19.138Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_double_entry:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshDoubleEntry.ULID\u0027"
],
"packageName": "ash_double_entry",
"packageURL": "pkg:hex/ash_double_entry",
"product": "ash_double_entry",
"programFiles": [
"lib/ulid.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshDoubleEntry.ULID\u0027:cast_input/2"
},
{
"name": "\u0027Elixir.AshDoubleEntry.ULID\u0027:dump_to_native/2"
}
],
"repo": "https://github.com/ash-project/ash_double_entry",
"vendor": "ash-project",
"versions": [
{
"lessThan": "1.0.19",
"status": "affected",
"version": "0.1.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_double_entry:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshDoubleEntry.ULID\u0027"
],
"packageName": "ash-project/ash_double_entry",
"packageURL": "pkg:github/ash-project/ash_double_entry",
"product": "ash_double_entry",
"programFiles": [
"lib/ulid.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshDoubleEntry.ULID\u0027:cast_input/2"
},
{
"name": "\u0027Elixir.AshDoubleEntry.ULID\u0027:dump_to_native/2"
}
],
"repo": "https://github.com/ash-project/ash_double_entry",
"vendor": "ash-project",
"versions": [
{
"lessThan": "d3e688d300a581ae214b3ca7d95ef4de63fbb050",
"status": "affected",
"version": "1e5f7ce8ff25f519c904731a29eb1258324e561a",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eReachable only when an application exposes \u003ccode\u003eAshDoubleEntry.ULID\u003c/code\u003e as a public identifier over an HTTP or API boundary and performs string-level checks on the submitted ID (idempotency or deduplication keys, deny-lists, audit correlation, or signatures) rather than treating the value as opaque.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Reachable only when an application exposes `AshDoubleEntry.ULID` as a public identifier over an HTTP or API boundary and performs string-level checks on the submitted ID (idempotency or deduplication keys, deny-lists, audit correlation, or signatures) rather than treating the value as opaque."
}
],
"value": "Reachable only when an application exposes AshDoubleEntry.ULID as a public identifier over an HTTP or API boundary and performs string-level checks on the submitted ID (idempotency or deduplication keys, deny-lists, audit correlation, or signatures) rather than treating the value as opaque."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_double_entry:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.0.19",
"versionStartIncluding": "0.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Handling of Alternate Encoding vulnerability in ash-project ash_double_entry allows an attacker to submit several distinct string spellings of the same identifier.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eAshDoubleEntry.ULID\u003c/code\u003e renders a 128-bit ULID as 26 Crockford base-32 characters, but the first character encodes only 3 bits, so canonical values are \u003ccode\u003e0\u003c/code\u003e to \u003ccode\u003e7\u003c/code\u003e. \u003ccode\u003edecode/1\u003c/code\u003e in \u003ccode\u003elib/ulid.ex\u003c/code\u003e masks the first character to its low 3 bits and \u003ccode\u003evalid?/1\u003c/code\u003e accepts all 32 characters in that position, so \u003ccode\u003e0...\u003c/code\u003e, \u003ccode\u003e8...\u003c/code\u003e, \u003ccode\u003eG...\u003c/code\u003e and \u003ccode\u003eR...\u003c/code\u003e decode to the identical 16-byte value and resolve to the same row. When the type is exposed as a public ID over an HTTP or API boundary, an attacker-supplied ID can be spelled differently from the record it actually reads or writes, desynchronizing or bypassing string-level checks such as idempotency and deduplication keys, deny-lists, audit correlation, or signatures computed over the submitted ID.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_double_entry: from 0.1.0 before 1.0.19.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Improper Handling of Alternate Encoding vulnerability in ash-project ash_double_entry allows an attacker to submit several distinct string spellings of the same identifier.\n\n`AshDoubleEntry.ULID` renders a 128-bit ULID as 26 Crockford base-32 characters, but the first character encodes only 3 bits, so canonical values are `0` to `7`. `decode/1` in `lib/ulid.ex` masks the first character to its low 3 bits and `valid?/1` accepts all 32 characters in that position, so `0...`, `8...`, `G...` and `R...` decode to the identical 16-byte value and resolve to the same row. When the type is exposed as a public ID over an HTTP or API boundary, an attacker-supplied ID can be spelled differently from the record it actually reads or writes, desynchronizing or bypassing string-level checks such as idempotency and deduplication keys, deny-lists, audit correlation, or signatures computed over the submitted ID.\n\nThis issue affects ash_double_entry: from 0.1.0 before 1.0.19."
}
],
"value": "Improper Handling of Alternate Encoding vulnerability in ash-project ash_double_entry allows an attacker to submit several distinct string spellings of the same identifier.\n\nAshDoubleEntry.ULID renders a 128-bit ULID as 26 Crockford base-32 characters, but the first character encodes only 3 bits, so canonical values are 0 to 7. decode/1 in lib/ulid.ex masks the first character to its low 3 bits and valid?/1 accepts all 32 characters in that position, so 0..., 8..., G... and R... decode to the identical 16-byte value and resolve to the same row. When the type is exposed as a public ID over an HTTP or API boundary, an attacker-supplied ID can be spelled differently from the record it actually reads or writes, desynchronizing or bypassing string-level checks such as idempotency and deduplication keys, deny-lists, audit correlation, or signatures computed over the submitted ID.\n\nThis issue affects ash_double_entry: from 0.1.0 before 1.0.19."
}
],
"impacts": [
{
"capecId": "CAPEC-267",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-267 Leverage Alternate Encoding"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 2.1,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-173",
"description": "CWE-173 Improper Handling of Alternate Encoding",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T22:33:29.297Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash_double_entry/security/advisories/GHSA-qxp2-vgp9-268q"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-81638.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-81638"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_double_entry/commit/d3e688d300a581ae214b3ca7d95ef4de63fbb050"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Non-canonical ULID spellings are accepted and alias to the same record in ash_double_entry"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-81638",
"datePublished": "2026-09-07T22:33:29.297Z",
"dateReserved": "2026-09-07T19:30:01.624Z",
"dateUpdated": "2026-09-08T14:44:19.138Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82758 (GCVE-0-2026-82758)
Vulnerability from cvelistv5 – Published: 2026-09-07 22:32 – Updated: 2026-09-08 14:41
VLAI
EPSS
VEX
Title
ash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gated Dynamic Client Registration endpoint
Summary
Improper Authentication vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token.
resolve_secret/3 in AshAuthentication.Oauth2Server (reached through __resolve_secret__!) treated any return other than {:ok, _} or :error from a configured {module, function, args} or 2-arity-function secret provider as a valid secret, wrapping nil, false, or "" as {:ok, value}. When the initial_access_token resolves to such an empty value, POST /oauth/register compares the presented bearer token against it and the comparison passes with no token supplied, so registration is open although it was configured closed. The same fail-open affected other resolved secrets such as signing_secret.
This issue affects ash_authentication_oauth2_server: from 0.1.0 before 0.3.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 14:40 UTC
CWE
- CWE-287 - Improper Authentication
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash_authentication… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82758.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82758 | related |
| https://github.com/ash-project/ash_authentication… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_authentication_oauth2_server |
Affected:
0.1.0 , < 0.3.1
(semver)
cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:* |
|
| ash-project | ash_authentication_oauth2_server |
Affected:
855b578037c5ded18e8a6e60f42e56bde4905fae , < 30a87101871775d27d79f9ad6f29eafa4779e118
(git)
cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82758",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T14:40:53.437993Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T14:41:06.227Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAuthentication.Oauth2Server\u0027"
],
"packageName": "ash_authentication_oauth2_server",
"packageURL": "pkg:hex/ash_authentication_oauth2_server",
"product": "ash_authentication_oauth2_server",
"programFiles": [
"lib/ash_authentication/oauth2_server.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAuthentication.Oauth2Server\u0027:__resolve_secret__!/3"
}
],
"repo": "https://github.com/ash-project/ash_authentication_oauth2_server",
"vendor": "ash-project",
"versions": [
{
"lessThan": "0.3.1",
"status": "affected",
"version": "0.1.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAuthentication.Oauth2Server\u0027"
],
"packageName": "ash-project/ash_authentication_oauth2_server",
"packageURL": "pkg:github/ash-project/ash_authentication_oauth2_server",
"product": "ash_authentication_oauth2_server",
"programFiles": [
"lib/ash_authentication/oauth2_server.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAuthentication.Oauth2Server\u0027:__resolve_secret__!/3"
}
],
"repo": "https://github.com/ash-project/ash_authentication_oauth2_server",
"vendor": "ash-project",
"versions": [
{
"lessThan": "30a87101871775d27d79f9ad6f29eafa4779e118",
"status": "affected",
"version": "855b578037c5ded18e8a6e60f42e56bde4905fae",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eReachable only when the server configures an \u003ccode\u003einitial_access_token\u003c/code\u003e (so Dynamic Client Registration is meant to require one) and the configured secret provider returns an empty value (\u003ccode\u003enil\u003c/code\u003e, \u003ccode\u003efalse\u003c/code\u003e, or \u003ccode\u003e\"\"\u003c/code\u003e) or an \u003ccode\u003e{:error, _}\u003c/code\u003e for it, rather than a non-empty binary.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Reachable only when the server configures an `initial_access_token` (so Dynamic Client Registration is meant to require one) and the configured secret provider returns an empty value (`nil`, `false`, or `\"\"`) or an `{:error, _}` for it, rather than a non-empty binary."
}
],
"value": "Reachable only when the server configures an initial_access_token (so Dynamic Client Registration is meant to require one) and the configured secret provider returns an empty value (nil, false, or \"\") or an {:error, _} for it, rather than a non-empty binary."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.3.1",
"versionStartIncluding": "0.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Authentication vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eresolve_secret/3\u003c/code\u003e in \u003ccode\u003eAshAuthentication.Oauth2Server\u003c/code\u003e (reached through \u003ccode\u003e__resolve_secret__!\u003c/code\u003e) treated any return other than \u003ccode\u003e{:ok, _}\u003c/code\u003e or \u003ccode\u003e:error\u003c/code\u003e from a configured \u003ccode\u003e{module, function, args}\u003c/code\u003e or 2-arity-function secret provider as a valid secret, wrapping \u003ccode\u003enil\u003c/code\u003e, \u003ccode\u003efalse\u003c/code\u003e, or \u003ccode\u003e\"\"\u003c/code\u003e as \u003ccode\u003e{:ok, value}\u003c/code\u003e. When the \u003ccode\u003einitial_access_token\u003c/code\u003e resolves to such an empty value, \u003ccode\u003ePOST /oauth/register\u003c/code\u003e compares the presented bearer token against it and the comparison passes with no token supplied, so registration is open although it was configured closed. The same fail-open affected other resolved secrets such as \u003ccode\u003esigning_secret\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_authentication_oauth2_server: from 0.1.0 before 0.3.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Improper Authentication vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token.\n\n`resolve_secret/3` in `AshAuthentication.Oauth2Server` (reached through `__resolve_secret__!`) treated any return other than `{:ok, _}` or `:error` from a configured `{module, function, args}` or 2-arity-function secret provider as a valid secret, wrapping `nil`, `false`, or `\"\"` as `{:ok, value}`. When the `initial_access_token` resolves to such an empty value, `POST /oauth/register` compares the presented bearer token against it and the comparison passes with no token supplied, so registration is open although it was configured closed. The same fail-open affected other resolved secrets such as `signing_secret`.\n\nThis issue affects ash_authentication_oauth2_server: from 0.1.0 before 0.3.1."
}
],
"value": "Improper Authentication vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token.\n\nresolve_secret/3 in AshAuthentication.Oauth2Server (reached through __resolve_secret__!) treated any return other than {:ok, _} or :error from a configured {module, function, args} or 2-arity-function secret provider as a valid secret, wrapping nil, false, or \"\" as {:ok, value}. When the initial_access_token resolves to such an empty value, POST /oauth/register compares the presented bearer token against it and the comparison passes with no token supplied, so registration is open although it was configured closed. The same fail-open affected other resolved secrets such as signing_secret.\n\nThis issue affects ash_authentication_oauth2_server: from 0.1.0 before 0.3.1."
}
],
"impacts": [
{
"capecId": "CAPEC-115",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-115 Authentication Bypass"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287 Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T22:32:17.027Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash_authentication_oauth2_server/security/advisories/GHSA-fxc6-vp68-87pw"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82758.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82758"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_authentication_oauth2_server/commit/30a87101871775d27d79f9ad6f29eafa4779e118"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "ash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gated Dynamic Client Registration endpoint"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82758",
"datePublished": "2026-09-07T22:32:17.027Z",
"dateReserved": "2026-08-31T01:00:10.817Z",
"dateUpdated": "2026-09-08T14:41:06.227Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82757 (GCVE-0-2026-82757)
Vulnerability from cvelistv5 – Published: 2026-09-07 22:31 – Updated: 2026-09-08 14:43
VLAI
EPSS
VEX
Title
ash_authentication_oauth2_server CIMD fetcher classifies IPv4-in-IPv6 and site-local addresses as public, allowing SSRF
Summary
Server-Side Request Forgery (SSRF) vulnerability in ash-project ash_authentication_oauth2_server allows an attacker who controls a client metadata URL and its DNS to make the server connect to internal or loopback addresses.
public_ip?/1 in AshAuthentication.Oauth2Server.CIMD.ReqFetcher enforces the outbound policy for CIMD metadata fetches. It classified several address forms as publicly routable that are not: IPv4-compatible ::/96 (for example ::127.0.0.1), SIIT IPv4-translated ::ffff:0:0:0/96, and deprecated site-local fec0::/10. A returned AAAA record in one of these ranges passed the policy, so a fetch pinned to that address reached space the policy was meant to block.
This issue affects ash_authentication_oauth2_server: from 0.3.0 before 0.3.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 14:43 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash_authentication… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82757.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82757 | related |
| https://github.com/ash-project/ash_authentication… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_authentication_oauth2_server |
Affected:
0.3.0 , < 0.3.1
(semver)
cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:* |
|
| ash-project | ash_authentication_oauth2_server |
Affected:
e713a9ba816761140c226e2ca55b75c0b93f5984 , < 268b591261a3473ab9b87272963e4dd2fd99d972
(git)
cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82757",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T14:43:50.818031Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T14:43:57.511Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAuthentication.Oauth2Server.CIMD.ReqFetcher\u0027"
],
"packageName": "ash_authentication_oauth2_server",
"packageURL": "pkg:hex/ash_authentication_oauth2_server",
"product": "ash_authentication_oauth2_server",
"programFiles": [
"lib/ash_authentication/oauth2_server/cimd/req_fetcher.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAuthentication.Oauth2Server.CIMD.ReqFetcher\u0027:public_ip?/1"
},
{
"name": "\u0027Elixir.AshAuthentication.Oauth2Server.CIMD.ReqFetcher\u0027:fetch/2"
}
],
"repo": "https://github.com/ash-project/ash_authentication_oauth2_server",
"vendor": "ash-project",
"versions": [
{
"lessThan": "0.3.1",
"status": "affected",
"version": "0.3.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAuthentication.Oauth2Server.CIMD.ReqFetcher\u0027"
],
"packageName": "ash-project/ash_authentication_oauth2_server",
"packageURL": "pkg:github/ash-project/ash_authentication_oauth2_server",
"product": "ash_authentication_oauth2_server",
"programFiles": [
"lib/ash_authentication/oauth2_server/cimd/req_fetcher.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAuthentication.Oauth2Server.CIMD.ReqFetcher\u0027:public_ip?/1"
},
{
"name": "\u0027Elixir.AshAuthentication.Oauth2Server.CIMD.ReqFetcher\u0027:fetch/2"
}
],
"repo": "https://github.com/ash-project/ash_authentication_oauth2_server",
"vendor": "ash-project",
"versions": [
{
"lessThan": "268b591261a3473ab9b87272963e4dd2fd99d972",
"status": "affected",
"version": "e713a9ba816761140c226e2ca55b75c0b93f5984",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eReachable only when Client ID Metadata Documents are enabled (\u003ccode\u003ecimd_enabled?: true\u003c/code\u003e), so the authorize endpoint fetches attacker-suppliable metadata URLs, and an internal or loopback target resolves to one of the affected IPv6 address forms.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Reachable only when Client ID Metadata Documents are enabled (`cimd_enabled?: true`), so the authorize endpoint fetches attacker-suppliable metadata URLs, and an internal or loopback target resolves to one of the affected IPv6 address forms."
}
],
"value": "Reachable only when Client ID Metadata Documents are enabled (cimd_enabled?: true), so the authorize endpoint fetches attacker-suppliable metadata URLs, and an internal or loopback target resolves to one of the affected IPv6 address forms."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.3.1",
"versionStartIncluding": "0.3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eServer-Side Request Forgery (SSRF) vulnerability in ash-project ash_authentication_oauth2_server allows an attacker who controls a client metadata URL and its DNS to make the server connect to internal or loopback addresses.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003epublic_ip?/1\u003c/code\u003e in \u003ccode\u003eAshAuthentication.Oauth2Server.CIMD.ReqFetcher\u003c/code\u003e enforces the outbound policy for CIMD metadata fetches. It classified several address forms as publicly routable that are not: IPv4-compatible \u003ccode\u003e::/96\u003c/code\u003e (for example \u003ccode\u003e::127.0.0.1\u003c/code\u003e), SIIT IPv4-translated \u003ccode\u003e::ffff:0:0:0/96\u003c/code\u003e, and deprecated site-local \u003ccode\u003efec0::/10\u003c/code\u003e. A returned AAAA record in one of these ranges passed the policy, so a fetch pinned to that address reached space the policy was meant to block.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_authentication_oauth2_server: from 0.3.0 before 0.3.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Server-Side Request Forgery (SSRF) vulnerability in ash-project ash_authentication_oauth2_server allows an attacker who controls a client metadata URL and its DNS to make the server connect to internal or loopback addresses.\n\n`public_ip?/1` in `AshAuthentication.Oauth2Server.CIMD.ReqFetcher` enforces the outbound policy for CIMD metadata fetches. It classified several address forms as publicly routable that are not: IPv4-compatible `::/96` (for example `::127.0.0.1`), SIIT IPv4-translated `::ffff:0:0:0/96`, and deprecated site-local `fec0::/10`. A returned AAAA record in one of these ranges passed the policy, so a fetch pinned to that address reached space the policy was meant to block.\n\nThis issue affects ash_authentication_oauth2_server: from 0.3.0 before 0.3.1."
}
],
"value": "Server-Side Request Forgery (SSRF) vulnerability in ash-project ash_authentication_oauth2_server allows an attacker who controls a client metadata URL and its DNS to make the server connect to internal or loopback addresses.\n\npublic_ip?/1 in AshAuthentication.Oauth2Server.CIMD.ReqFetcher enforces the outbound policy for CIMD metadata fetches. It classified several address forms as publicly routable that are not: IPv4-compatible ::/96 (for example ::127.0.0.1), SIIT IPv4-translated ::ffff:0:0:0/96, and deprecated site-local fec0::/10. A returned AAAA record in one of these ranges passed the policy, so a fetch pinned to that address reached space the policy was meant to block.\n\nThis issue affects ash_authentication_oauth2_server: from 0.3.0 before 0.3.1."
}
],
"impacts": [
{
"capecId": "CAPEC-664",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-664 Server Side Request Forgery"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T22:31:34.656Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash_authentication_oauth2_server/security/advisories/GHSA-wprp-8gvj-p6cv"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82757.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82757"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_authentication_oauth2_server/commit/268b591261a3473ab9b87272963e4dd2fd99d972"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "ash_authentication_oauth2_server CIMD fetcher classifies IPv4-in-IPv6 and site-local addresses as public, allowing SSRF"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82757",
"datePublished": "2026-09-07T22:31:34.656Z",
"dateReserved": "2026-08-31T01:00:10.817Z",
"dateUpdated": "2026-09-08T14:43:57.511Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82756 (GCVE-0-2026-82756)
Vulnerability from cvelistv5 – Published: 2026-09-07 22:30 – Updated: 2026-09-08 14:43
VLAI
EPSS
VEX
Title
ash_authentication_oauth2_server interpolates a tenant-derived value into the WWW-Authenticate challenge without escaping, allowing header parameter injection
Summary
Improper Encoding or Escaping of Output vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to inject arbitrary authentication parameters into the WWW-Authenticate challenge header.
BearerPlug and RequireScopePlug built the Bearer resource_metadata="..." challenge by interpolating a resource_metadata URL derived from the request tenant directly into the quoted value. In a multi-tenant application that sets the Ash tenant from request-controlled data (a subdomain, the Host, a path segment, or a header), a tenant containing a " closes the quoted value and appends attacker-chosen auth-params, including a second resource_metadata URL pointing at an attacker-controlled authorization server that spec-following clients follow. Carriage returns and line feeds are rejected by Plug, so this is parameter injection within one header, not response splitting.
This issue affects ash_authentication_oauth2_server: from 0.1.3 before 0.3.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 14:43 UTC
CWE
- CWE-116 - Improper Encoding or Escaping of Output
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash_authentication… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82756.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82756 | related |
| https://github.com/ash-project/ash_authentication… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_authentication_oauth2_server |
Affected:
0.1.3 , < 0.3.1
(semver)
cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:* |
|
| ash-project | ash_authentication_oauth2_server |
Affected:
99de0a1cacb5ef667c4533278b7c81ca98c00231 , < 09f97476715da031b136eaec7b2cda2363ad8149
(git)
cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82756",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T14:43:23.093058Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T14:43:33.571Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.BearerPlug\u0027",
"\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.RequireScopePlug\u0027"
],
"packageName": "ash_authentication_oauth2_server",
"packageURL": "pkg:hex/ash_authentication_oauth2_server",
"product": "ash_authentication_oauth2_server",
"programFiles": [
"lib/ash_authentication_phoenix/oauth2_server/bearer_plug.ex",
"lib/ash_authentication_phoenix/oauth2_server/require_scope_plug.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.BearerPlug\u0027:call/2"
},
{
"name": "\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.RequireScopePlug\u0027:call/2"
}
],
"repo": "https://github.com/ash-project/ash_authentication_oauth2_server",
"vendor": "ash-project",
"versions": [
{
"lessThan": "0.3.1",
"status": "affected",
"version": "0.1.3",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.BearerPlug\u0027",
"\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.RequireScopePlug\u0027"
],
"packageName": "ash-project/ash_authentication_oauth2_server",
"packageURL": "pkg:github/ash-project/ash_authentication_oauth2_server",
"product": "ash_authentication_oauth2_server",
"programFiles": [
"lib/ash_authentication_phoenix/oauth2_server/bearer_plug.ex",
"lib/ash_authentication_phoenix/oauth2_server/require_scope_plug.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.BearerPlug\u0027:call/2"
},
{
"name": "\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.RequireScopePlug\u0027:call/2"
}
],
"repo": "https://github.com/ash-project/ash_authentication_oauth2_server",
"vendor": "ash-project",
"versions": [
{
"lessThan": "09f97476715da031b136eaec7b2cda2363ad8149",
"status": "affected",
"version": "99de0a1cacb5ef667c4533278b7c81ca98c00231",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eReachable only in a multi-tenant application that derives the Ash tenant from request-controlled input (subdomain, \u003ccode\u003eHost\u003c/code\u003e, path, or header) and uses \u003ccode\u003eBearerPlug\u003c/code\u003e or \u003ccode\u003eRequireScopePlug\u003c/code\u003e; the tenant reaches the challenge through the server\u0027s tenant-aware \u003ccode\u003eresource_url\u003c/code\u003e.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Reachable only in a multi-tenant application that derives the Ash tenant from request-controlled input (subdomain, `Host`, path, or header) and uses `BearerPlug` or `RequireScopePlug`; the tenant reaches the challenge through the server\u0027s tenant-aware `resource_url`."
}
],
"value": "Reachable only in a multi-tenant application that derives the Ash tenant from request-controlled input (subdomain, Host, path, or header) and uses BearerPlug or RequireScopePlug; the tenant reaches the challenge through the server\u0027s tenant-aware resource_url."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.3.1",
"versionStartIncluding": "0.1.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Encoding or Escaping of Output vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to inject arbitrary authentication parameters into the \u003ccode\u003eWWW-Authenticate\u003c/code\u003e challenge header.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eBearerPlug\u003c/code\u003e and \u003ccode\u003eRequireScopePlug\u003c/code\u003e built the \u003ccode\u003eBearer resource_metadata=\"...\"\u003c/code\u003e challenge by interpolating a \u003ccode\u003eresource_metadata\u003c/code\u003e URL derived from the request tenant directly into the quoted value. In a multi-tenant application that sets the Ash tenant from request-controlled data (a subdomain, the \u003ccode\u003eHost\u003c/code\u003e, a path segment, or a header), a tenant containing a \u003ccode\u003e\"\u003c/code\u003e closes the quoted value and appends attacker-chosen auth-params, including a second \u003ccode\u003eresource_metadata\u003c/code\u003e URL pointing at an attacker-controlled authorization server that spec-following clients follow. Carriage returns and line feeds are rejected by Plug, so this is parameter injection within one header, not response splitting.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_authentication_oauth2_server: from 0.1.3 before 0.3.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Improper Encoding or Escaping of Output vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to inject arbitrary authentication parameters into the `WWW-Authenticate` challenge header.\n\n`BearerPlug` and `RequireScopePlug` built the `Bearer resource_metadata=\"...\"` challenge by interpolating a `resource_metadata` URL derived from the request tenant directly into the quoted value. In a multi-tenant application that sets the Ash tenant from request-controlled data (a subdomain, the `Host`, a path segment, or a header), a tenant containing a `\"` closes the quoted value and appends attacker-chosen auth-params, including a second `resource_metadata` URL pointing at an attacker-controlled authorization server that spec-following clients follow. Carriage returns and line feeds are rejected by Plug, so this is parameter injection within one header, not response splitting.\n\nThis issue affects ash_authentication_oauth2_server: from 0.1.3 before 0.3.1."
}
],
"value": "Improper Encoding or Escaping of Output vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to inject arbitrary authentication parameters into the WWW-Authenticate challenge header.\n\nBearerPlug and RequireScopePlug built the Bearer resource_metadata=\"...\" challenge by interpolating a resource_metadata URL derived from the request tenant directly into the quoted value. In a multi-tenant application that sets the Ash tenant from request-controlled data (a subdomain, the Host, a path segment, or a header), a tenant containing a \" closes the quoted value and appends attacker-chosen auth-params, including a second resource_metadata URL pointing at an attacker-controlled authorization server that spec-following clients follow. Carriage returns and line feeds are rejected by Plug, so this is parameter injection within one header, not response splitting.\n\nThis issue affects ash_authentication_oauth2_server: from 0.1.3 before 0.3.1."
}
],
"impacts": [
{
"capecId": "CAPEC-153",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-153 Input Data Manipulation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-116",
"description": "CWE-116 Improper Encoding or Escaping of Output",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T22:30:55.280Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash_authentication_oauth2_server/security/advisories/GHSA-2h3v-83jg-2qmm"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82756.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82756"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_authentication_oauth2_server/commit/09f97476715da031b136eaec7b2cda2363ad8149"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "ash_authentication_oauth2_server interpolates a tenant-derived value into the WWW-Authenticate challenge without escaping, allowing header parameter injection"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82756",
"datePublished": "2026-09-07T22:30:55.280Z",
"dateReserved": "2026-08-31T01:00:10.817Z",
"dateUpdated": "2026-09-08T14:43:33.571Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82755 (GCVE-0-2026-82755)
Vulnerability from cvelistv5 – Published: 2026-09-07 22:28 – Updated: 2026-09-08 14:42
VLAI
EPSS
VEX
Title
ash_authentication_oauth2_server serves tenant-specific OAuth metadata as publicly cacheable without Vary, enabling cross-tenant confusion
Summary
Use of Cache Containing Sensitive Information vulnerability in ash-project ash_authentication_oauth2_server allows a shared HTTP cache to serve one tenant's OAuth discovery metadata to another tenant's clients.
The RFC 8414 and RFC 9728 metadata endpoints in AshAuthentication.Phoenix.Oauth2Server.ProtocolRouter return tenant-specific values (issuer, authorization_endpoint, token_endpoint, jwks_uri) when a tenant is set, but sent them with Cache-Control: public, max-age=3600 and no Vary. When the tenant is derived from something other than the URL (a header or the Host) and a shared cache sits in front, the cache key is the URL alone, so a stored response for one tenant is served to another for up to an hour. Affected clients may then send authorization codes and secrets to the wrong tenant's token endpoint and validate tokens against the wrong keys.
This issue affects ash_authentication_oauth2_server: from 0.1.3 before 0.3.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 14:42 UTC
CWE
- CWE-524 - Use of Cache Containing Sensitive Information
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash_authentication… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82755.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82755 | related |
| https://github.com/ash-project/ash_authentication… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_authentication_oauth2_server |
Affected:
0.1.3 , < 0.3.1
(semver)
cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:* |
|
| ash-project | ash_authentication_oauth2_server |
Affected:
99de0a1cacb5ef667c4533278b7c81ca98c00231 , < 768d87f70e4e97ae1d2bf1606b5bf3f4d03f24a1
(git)
cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82755",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T14:42:10.746522Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T14:42:17.718Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.ProtocolRouter\u0027"
],
"packageName": "ash_authentication_oauth2_server",
"packageURL": "pkg:hex/ash_authentication_oauth2_server",
"product": "ash_authentication_oauth2_server",
"programFiles": [
"lib/ash_authentication_phoenix/oauth2_server/protocol_router.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.ProtocolRouter\u0027:call/2"
}
],
"repo": "https://github.com/ash-project/ash_authentication_oauth2_server",
"vendor": "ash-project",
"versions": [
{
"lessThan": "0.3.1",
"status": "affected",
"version": "0.1.3",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.ProtocolRouter\u0027"
],
"packageName": "ash-project/ash_authentication_oauth2_server",
"packageURL": "pkg:github/ash-project/ash_authentication_oauth2_server",
"product": "ash_authentication_oauth2_server",
"programFiles": [
"lib/ash_authentication_phoenix/oauth2_server/protocol_router.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.ProtocolRouter\u0027:call/2"
}
],
"repo": "https://github.com/ash-project/ash_authentication_oauth2_server",
"vendor": "ash-project",
"versions": [
{
"lessThan": "768d87f70e4e97ae1d2bf1606b5bf3f4d03f24a1",
"status": "affected",
"version": "99de0a1cacb5ef667c4533278b7c81ca98c00231",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eReachable only in a multi-tenant deployment where the tenant is derived from outside the request URL (a header or the \u003ccode\u003eHost\u003c/code\u003e) and a shared HTTP cache (CDN, reverse proxy) sits in front of the metadata endpoints.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Reachable only in a multi-tenant deployment where the tenant is derived from outside the request URL (a header or the `Host`) and a shared HTTP cache (CDN, reverse proxy) sits in front of the metadata endpoints."
}
],
"value": "Reachable only in a multi-tenant deployment where the tenant is derived from outside the request URL (a header or the Host) and a shared HTTP cache (CDN, reverse proxy) sits in front of the metadata endpoints."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.3.1",
"versionStartIncluding": "0.1.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUse of Cache Containing Sensitive Information vulnerability in ash-project ash_authentication_oauth2_server allows a shared HTTP cache to serve one tenant\u0027s OAuth discovery metadata to another tenant\u0027s clients.\u003c/p\u003e\n\u003cp\u003eThe RFC 8414 and RFC 9728 metadata endpoints in \u003ccode\u003eAshAuthentication.Phoenix.Oauth2Server.ProtocolRouter\u003c/code\u003e return tenant-specific values (\u003ccode\u003eissuer\u003c/code\u003e, \u003ccode\u003eauthorization_endpoint\u003c/code\u003e, \u003ccode\u003etoken_endpoint\u003c/code\u003e, \u003ccode\u003ejwks_uri\u003c/code\u003e) when a tenant is set, but sent them with \u003ccode\u003eCache-Control: public, max-age=3600\u003c/code\u003e and no \u003ccode\u003eVary\u003c/code\u003e. When the tenant is derived from something other than the URL (a header or the \u003ccode\u003eHost\u003c/code\u003e) and a shared cache sits in front, the cache key is the URL alone, so a stored response for one tenant is served to another for up to an hour. Affected clients may then send authorization codes and secrets to the wrong tenant\u0027s token endpoint and validate tokens against the wrong keys.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_authentication_oauth2_server: from 0.1.3 before 0.3.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Use of Cache Containing Sensitive Information vulnerability in ash-project ash_authentication_oauth2_server allows a shared HTTP cache to serve one tenant\u0027s OAuth discovery metadata to another tenant\u0027s clients.\n\nThe RFC 8414 and RFC 9728 metadata endpoints in `AshAuthentication.Phoenix.Oauth2Server.ProtocolRouter` return tenant-specific values (`issuer`, `authorization_endpoint`, `token_endpoint`, `jwks_uri`) when a tenant is set, but sent them with `Cache-Control: public, max-age=3600` and no `Vary`. When the tenant is derived from something other than the URL (a header or the `Host`) and a shared cache sits in front, the cache key is the URL alone, so a stored response for one tenant is served to another for up to an hour. Affected clients may then send authorization codes and secrets to the wrong tenant\u0027s token endpoint and validate tokens against the wrong keys.\n\nThis issue affects ash_authentication_oauth2_server: from 0.1.3 before 0.3.1."
}
],
"value": "Use of Cache Containing Sensitive Information vulnerability in ash-project ash_authentication_oauth2_server allows a shared HTTP cache to serve one tenant\u0027s OAuth discovery metadata to another tenant\u0027s clients.\n\nThe RFC 8414 and RFC 9728 metadata endpoints in AshAuthentication.Phoenix.Oauth2Server.ProtocolRouter return tenant-specific values (issuer, authorization_endpoint, token_endpoint, jwks_uri) when a tenant is set, but sent them with Cache-Control: public, max-age=3600 and no Vary. When the tenant is derived from something other than the URL (a header or the Host) and a shared cache sits in front, the cache key is the URL alone, so a stored response for one tenant is served to another for up to an hour. Affected clients may then send authorization codes and secrets to the wrong tenant\u0027s token endpoint and validate tokens against the wrong keys.\n\nThis issue affects ash_authentication_oauth2_server: from 0.1.3 before 0.3.1."
}
],
"impacts": [
{
"capecId": "CAPEC-204",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-204 Lifting Sensitive Data Embedded in Cache"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-524",
"description": "CWE-524 Use of Cache Containing Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T22:28:24.500Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash_authentication_oauth2_server/security/advisories/GHSA-crqf-7m54-4hgc"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82755.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82755"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_authentication_oauth2_server/commit/768d87f70e4e97ae1d2bf1606b5bf3f4d03f24a1"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "ash_authentication_oauth2_server serves tenant-specific OAuth metadata as publicly cacheable without Vary, enabling cross-tenant confusion"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82755",
"datePublished": "2026-09-07T22:28:24.500Z",
"dateReserved": "2026-08-31T01:00:10.817Z",
"dateUpdated": "2026-09-08T14:42:17.718Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82754 (GCVE-0-2026-82754)
Vulnerability from cvelistv5 – Published: 2026-09-07 22:23 – Updated: 2026-09-08 14:41
VLAI
EPSS
VEX
Title
ash_authentication_oauth2_server aliases every protocol endpoint under /.well-known, bypassing path-scoped controls
Summary
Improper Protection of Alternate Path vulnerability in ash-project ash_authentication_oauth2_server exposes the state-changing OAuth endpoints under an unintended URL prefix, bypassing controls scoped to the canonical prefix.
oauth2_server_protocol_routes/1 in AshAuthentication.Phoenix.Oauth2Server.Router forwards the same ProtocolRouter at both the /oauth prefix and the /.well-known prefix. Phoenix forward strips the matched prefix before dispatch, so the full route table answers under both mounts, and POST /register, POST /token, and POST /revoke are reachable as /.well-known/register, /.well-known/token, and /.well-known/revoke. Edge controls such as WAF rules, rate limits, or authentication exemptions written against the /oauth paths, or that allow-list /.well-known as unauthenticated, do not apply to the alias.
This issue affects ash_authentication_oauth2_server: from 0.1.0 before 0.3.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 14:41 UTC
CWE
- CWE-424 - Improper Protection of Alternate Path
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash_authentication… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82754.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82754 | related |
| https://github.com/ash-project/ash_authentication… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_authentication_oauth2_server |
Affected:
0.1.0 , < 0.3.1
(semver)
cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:* |
|
| ash-project | ash_authentication_oauth2_server |
Affected:
855b578037c5ded18e8a6e60f42e56bde4905fae , < a72972d7ed3eb74c05dfa0653a258ef14454459a
(git)
cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82754",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T14:41:33.862078Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T14:41:45.077Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.Router\u0027",
"\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.ProtocolRouter\u0027"
],
"packageName": "ash_authentication_oauth2_server",
"packageURL": "pkg:hex/ash_authentication_oauth2_server",
"product": "ash_authentication_oauth2_server",
"programFiles": [
"lib/ash_authentication_phoenix/oauth2_server/router.ex",
"lib/ash_authentication_phoenix/oauth2_server/protocol_router.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.Router\u0027:oauth2_server_protocol_routes/1"
},
{
"name": "\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.ProtocolRouter\u0027:call/2"
}
],
"repo": "https://github.com/ash-project/ash_authentication_oauth2_server",
"vendor": "ash-project",
"versions": [
{
"lessThan": "0.3.1",
"status": "affected",
"version": "0.1.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.Router\u0027",
"\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.ProtocolRouter\u0027"
],
"packageName": "ash-project/ash_authentication_oauth2_server",
"packageURL": "pkg:github/ash-project/ash_authentication_oauth2_server",
"product": "ash_authentication_oauth2_server",
"programFiles": [
"lib/ash_authentication_phoenix/oauth2_server/router.ex",
"lib/ash_authentication_phoenix/oauth2_server/protocol_router.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.Router\u0027:oauth2_server_protocol_routes/1"
},
{
"name": "\u0027Elixir.AshAuthentication.Phoenix.Oauth2Server.ProtocolRouter\u0027:call/2"
}
],
"repo": "https://github.com/ash-project/ash_authentication_oauth2_server",
"vendor": "ash-project",
"versions": [
{
"lessThan": "a72972d7ed3eb74c05dfa0653a258ef14454459a",
"status": "affected",
"version": "855b578037c5ded18e8a6e60f42e56bde4905fae",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe routing alias is unconditional. Exploitable impact depends on the deployment applying path-scoped edge controls (WAF, rate limiting, auth-redirect exemptions) to the \u003ccode\u003e/oauth\u003c/code\u003e prefix, or allow-listing \u003ccode\u003e/.well-known\u003c/code\u003e as unauthenticated, that the alias then bypasses.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "The routing alias is unconditional. Exploitable impact depends on the deployment applying path-scoped edge controls (WAF, rate limiting, auth-redirect exemptions) to the `/oauth` prefix, or allow-listing `/.well-known` as unauthenticated, that the alias then bypasses."
}
],
"value": "The routing alias is unconditional. Exploitable impact depends on the deployment applying path-scoped edge controls (WAF, rate limiting, auth-redirect exemptions) to the /oauth prefix, or allow-listing /.well-known as unauthenticated, that the alias then bypasses."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.3.1",
"versionStartIncluding": "0.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Protection of Alternate Path vulnerability in ash-project ash_authentication_oauth2_server exposes the state-changing OAuth endpoints under an unintended URL prefix, bypassing controls scoped to the canonical prefix.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eoauth2_server_protocol_routes/1\u003c/code\u003e in \u003ccode\u003eAshAuthentication.Phoenix.Oauth2Server.Router\u003c/code\u003e forwards the same \u003ccode\u003eProtocolRouter\u003c/code\u003e at both the \u003ccode\u003e/oauth\u003c/code\u003e prefix and the \u003ccode\u003e/.well-known\u003c/code\u003e prefix. Phoenix \u003ccode\u003eforward\u003c/code\u003e strips the matched prefix before dispatch, so the full route table answers under both mounts, and \u003ccode\u003ePOST /register\u003c/code\u003e, \u003ccode\u003ePOST /token\u003c/code\u003e, and \u003ccode\u003ePOST /revoke\u003c/code\u003e are reachable as \u003ccode\u003e/.well-known/register\u003c/code\u003e, \u003ccode\u003e/.well-known/token\u003c/code\u003e, and \u003ccode\u003e/.well-known/revoke\u003c/code\u003e. Edge controls such as WAF rules, rate limits, or authentication exemptions written against the \u003ccode\u003e/oauth\u003c/code\u003e paths, or that allow-list \u003ccode\u003e/.well-known\u003c/code\u003e as unauthenticated, do not apply to the alias.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_authentication_oauth2_server: from 0.1.0 before 0.3.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Improper Protection of Alternate Path vulnerability in ash-project ash_authentication_oauth2_server exposes the state-changing OAuth endpoints under an unintended URL prefix, bypassing controls scoped to the canonical prefix.\n\n`oauth2_server_protocol_routes/1` in `AshAuthentication.Phoenix.Oauth2Server.Router` forwards the same `ProtocolRouter` at both the `/oauth` prefix and the `/.well-known` prefix. Phoenix `forward` strips the matched prefix before dispatch, so the full route table answers under both mounts, and `POST /register`, `POST /token`, and `POST /revoke` are reachable as `/.well-known/register`, `/.well-known/token`, and `/.well-known/revoke`. Edge controls such as WAF rules, rate limits, or authentication exemptions written against the `/oauth` paths, or that allow-list `/.well-known` as unauthenticated, do not apply to the alias.\n\nThis issue affects ash_authentication_oauth2_server: from 0.1.0 before 0.3.1."
}
],
"value": "Improper Protection of Alternate Path vulnerability in ash-project ash_authentication_oauth2_server exposes the state-changing OAuth endpoints under an unintended URL prefix, bypassing controls scoped to the canonical prefix.\n\noauth2_server_protocol_routes/1 in AshAuthentication.Phoenix.Oauth2Server.Router forwards the same ProtocolRouter at both the /oauth prefix and the /.well-known prefix. Phoenix forward strips the matched prefix before dispatch, so the full route table answers under both mounts, and POST /register, POST /token, and POST /revoke are reachable as /.well-known/register, /.well-known/token, and /.well-known/revoke. Edge controls such as WAF rules, rate limits, or authentication exemptions written against the /oauth paths, or that allow-list /.well-known as unauthenticated, do not apply to the alias.\n\nThis issue affects ash_authentication_oauth2_server: from 0.1.0 before 0.3.1."
}
],
"impacts": [
{
"capecId": "CAPEC-554",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-554 Functionality Bypass"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-424",
"description": "CWE-424 Improper Protection of Alternate Path",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T22:23:56.762Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash_authentication_oauth2_server/security/advisories/GHSA-wwxg-h779-3wf4"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82754.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82754"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_authentication_oauth2_server/commit/a72972d7ed3eb74c05dfa0653a258ef14454459a"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "ash_authentication_oauth2_server aliases every protocol endpoint under /.well-known, bypassing path-scoped controls"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82754",
"datePublished": "2026-09-07T22:23:56.762Z",
"dateReserved": "2026-08-31T01:00:10.817Z",
"dateUpdated": "2026-09-08T14:41:45.077Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82753 (GCVE-0-2026-82753)
Vulnerability from cvelistv5 – Published: 2026-09-07 22:23 – Updated: 2026-09-08 14:39
VLAI
EPSS
VEX
Title
Unauthenticated authorize requests create unbounded, never-expiring CIMD client rows and cache entries in ash_authentication_oauth2_server
Summary
Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to exhaust database storage and memory.
The /authorize endpoint is unauthenticated by design. With Client ID Metadata Documents enabled, resolve_client/3 in AshAuthentication.Oauth2Server.CIMD fetches the document for each new URL-shaped client_id and upserts a client row, with no cap on the number of rows, no expiry or garbage collection, and no length bound on the fetched fields; the document was also placed in CIMD.Cache before validation, so even rejected documents held cache memory until their TTL. An attacker serving valid documents at many distinct URLs creates one permanent client row per URL, each able to carry multi-megabyte strings, growing storage and memory without bound.
This issue affects ash_authentication_oauth2_server: from 0.3.0 before 0.3.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 14:39 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash_authentication… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82753.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82753 | related |
| https://github.com/ash-project/ash_authentication… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_authentication_oauth2_server |
Affected:
0.3.0 , < 0.3.1
(semver)
cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:* |
|
| ash-project | ash_authentication_oauth2_server |
Affected:
e713a9ba816761140c226e2ca55b75c0b93f5984 , < 45e24f69e0f95d67413e2508acc2264156acb5ac
(git)
cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82753",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T14:39:20.932056Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T14:39:54.464Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAuthentication.Oauth2Server.CIMD\u0027"
],
"packageName": "ash_authentication_oauth2_server",
"packageURL": "pkg:hex/ash_authentication_oauth2_server",
"product": "ash_authentication_oauth2_server",
"programFiles": [
"lib/ash_authentication/oauth2_server/cimd.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAuthentication.Oauth2Server.CIMD\u0027:resolve_client/3"
}
],
"repo": "https://github.com/ash-project/ash_authentication_oauth2_server",
"vendor": "ash-project",
"versions": [
{
"lessThan": "0.3.1",
"status": "affected",
"version": "0.3.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAuthentication.Oauth2Server.CIMD\u0027"
],
"packageName": "ash-project/ash_authentication_oauth2_server",
"packageURL": "pkg:github/ash-project/ash_authentication_oauth2_server",
"product": "ash_authentication_oauth2_server",
"programFiles": [
"lib/ash_authentication/oauth2_server/cimd.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAuthentication.Oauth2Server.CIMD\u0027:resolve_client/3"
}
],
"repo": "https://github.com/ash-project/ash_authentication_oauth2_server",
"vendor": "ash-project",
"versions": [
{
"lessThan": "45e24f69e0f95d67413e2508acc2264156acb5ac",
"status": "affected",
"version": "e713a9ba816761140c226e2ca55b75c0b93f5984",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eReachable only when the client resource has Client ID Metadata Documents enabled (\u003ccode\u003ecimd_enabled?: true\u003c/code\u003e) and the authorize endpoint is exposed. CIMD is off by default.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Reachable only when the client resource has Client ID Metadata Documents enabled (`cimd_enabled?: true`) and the authorize endpoint is exposed. CIMD is off by default."
}
],
"value": "Reachable only when the client resource has Client ID Metadata Documents enabled (cimd_enabled?: true) and the authorize endpoint is exposed. CIMD is off by default."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.3.1",
"versionStartIncluding": "0.3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAllocation of Resources Without Limits or Throttling vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to exhaust database storage and memory.\u003c/p\u003e\n\u003cp\u003eThe \u003ccode\u003e/authorize\u003c/code\u003e endpoint is unauthenticated by design. With Client ID Metadata Documents enabled, \u003ccode\u003eresolve_client/3\u003c/code\u003e in \u003ccode\u003eAshAuthentication.Oauth2Server.CIMD\u003c/code\u003e fetches the document for each new URL-shaped \u003ccode\u003eclient_id\u003c/code\u003e and upserts a client row, with no cap on the number of rows, no expiry or garbage collection, and no length bound on the fetched fields; the document was also placed in \u003ccode\u003eCIMD.Cache\u003c/code\u003e before validation, so even rejected documents held cache memory until their TTL. An attacker serving valid documents at many distinct URLs creates one permanent client row per URL, each able to carry multi-megabyte strings, growing storage and memory without bound.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_authentication_oauth2_server: from 0.3.0 before 0.3.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to exhaust database storage and memory.\n\nThe `/authorize` endpoint is unauthenticated by design. With Client ID Metadata Documents enabled, `resolve_client/3` in `AshAuthentication.Oauth2Server.CIMD` fetches the document for each new URL-shaped `client_id` and upserts a client row, with no cap on the number of rows, no expiry or garbage collection, and no length bound on the fetched fields; the document was also placed in `CIMD.Cache` before validation, so even rejected documents held cache memory until their TTL. An attacker serving valid documents at many distinct URLs creates one permanent client row per URL, each able to carry multi-megabyte strings, growing storage and memory without bound.\n\nThis issue affects ash_authentication_oauth2_server: from 0.3.0 before 0.3.1."
}
],
"value": "Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to exhaust database storage and memory.\n\nThe /authorize endpoint is unauthenticated by design. With Client ID Metadata Documents enabled, resolve_client/3 in AshAuthentication.Oauth2Server.CIMD fetches the document for each new URL-shaped client_id and upserts a client row, with no cap on the number of rows, no expiry or garbage collection, and no length bound on the fetched fields; the document was also placed in CIMD.Cache before validation, so even rejected documents held cache memory until their TTL. An attacker serving valid documents at many distinct URLs creates one permanent client row per URL, each able to carry multi-megabyte strings, growing storage and memory without bound.\n\nThis issue affects ash_authentication_oauth2_server: from 0.3.0 before 0.3.1."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-130 Excessive Allocation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T22:23:08.176Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash_authentication_oauth2_server/security/advisories/GHSA-9pv3-wxjm-f846"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82753.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82753"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_authentication_oauth2_server/commit/45e24f69e0f95d67413e2508acc2264156acb5ac"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Unauthenticated authorize requests create unbounded, never-expiring CIMD client rows and cache entries in ash_authentication_oauth2_server"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82753",
"datePublished": "2026-09-07T22:23:08.176Z",
"dateReserved": "2026-08-31T01:00:10.817Z",
"dateUpdated": "2026-09-08T14:39:54.464Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82752 (GCVE-0-2026-82752)
Vulnerability from cvelistv5 – Published: 2026-09-05 17:16 – Updated: 2026-09-08 18:20
VLAI
EPSS
VEX
Title
Ash string length constraints count graphemes, so a combining-mark string of any size passes max_length
Summary
Improper Validation of Specified Quantity in Input vulnerability in ash-project ash allows an attacker to store a value of arbitrary size in an attribute whose length constraint should bound it.
Ash measures string length with Elixir's String.length/1, which counts Unicode graphemes, in the max_length and min_length constraints of Ash.Type.String (apply_constraints/2 in lib/ash/type/string.ex), in Ash.Resource.Validation.StringLength, and in the string_length expression function. A grapheme carries an unbounded number of combining marks, so a base character followed by a million combining acute accents is one grapheme and megabytes of data, and satisfies max_length: 2. Where the data layer imposes no independent limit (ETS, Mnesia, or a Postgres text column) the whole value is persisted, so an attacker can write an entire request body into an attribute declared with a small maximum and grow storage without bound.
The counting unit also disagrees with the storage layer, which counts codepoints rather than graphemes, so a value accepted by the constraint can still be rejected or truncated by the column. A Postgres varchar(n) column bounds the value itself and is not exposed.
This issue affects ash: from 0.10.0 before 3.33.0.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 18:19 UTC
CWE
- CWE-1284 - Improper Validation of Specified Quantity in Input
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash/security/advis… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82752.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82752 | related |
| https://github.com/ash-project/ash/commit/a64cab4… | patch |
| https://github.com/ash-project/ash/commit/cdbf4c4… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash |
Affected:
0.10.0 , < 3.33.0
(semver)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
|
| ash-project | ash |
Affected:
05848d5f4affe60fddd812222a18ada080c0813b , < *
(git)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82752",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T18:19:23.967428Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T18:20:03.503Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Type.String\u0027",
"\u0027Elixir.Ash.Resource.Validation.StringLength\u0027",
"\u0027Elixir.Ash.Query.Function.StringLength\u0027"
],
"packageName": "ash",
"packageURL": "pkg:hex/ash",
"product": "ash",
"programFiles": [
"lib/ash/type/string.ex",
"lib/ash/resource/validation/string_length.ex",
"lib/ash/query/function/string_length.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Type.String\u0027:apply_constraints/2"
},
{
"name": "\u0027Elixir.Ash.Type.String\u0027:apply_atomic_constraints/2"
},
{
"name": "\u0027Elixir.Ash.Resource.Validation.StringLength\u0027:validate/3"
},
{
"name": "\u0027Elixir.Ash.Resource.Validation.StringLength\u0027:atomic/3"
},
{
"name": "\u0027Elixir.Ash.Query.Function.StringLength\u0027:evaluate/1"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "3.33.0",
"status": "affected",
"version": "0.10.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Type.String\u0027",
"\u0027Elixir.Ash.Resource.Validation.StringLength\u0027",
"\u0027Elixir.Ash.Query.Function.StringLength\u0027"
],
"packageName": "ash-project/ash",
"packageURL": "pkg:github/ash-project/ash",
"product": "ash",
"programFiles": [
"lib/ash/type/string.ex",
"lib/ash/resource/validation/string_length.ex",
"lib/ash/query/function/string_length.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Type.String\u0027:apply_constraints/2"
},
{
"name": "\u0027Elixir.Ash.Type.String\u0027:apply_atomic_constraints/2"
},
{
"name": "\u0027Elixir.Ash.Resource.Validation.StringLength\u0027:validate/3"
},
{
"name": "\u0027Elixir.Ash.Resource.Validation.StringLength\u0027:atomic/3"
},
{
"name": "\u0027Elixir.Ash.Query.Function.StringLength\u0027:evaluate/1"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"changes": [
{
"at": "a64cab49b8886503e6b7c7b211d83c475aac48ca",
"status": "unaffected"
},
{
"at": "cdbf4c4da6bda5f6f139078f01a64320b595216d",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "05848d5f4affe60fddd812222a18ada080c0813b",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA resource attribute must carry a \u003ccode\u003emax_length\u003c/code\u003e constraint (or an equivalent \u003ccode\u003estring_length\u003c/code\u003e validation) fed from client input, and the data layer must impose no independent size limit of its own. The ETS and Mnesia data layers and Postgres \u003ccode\u003etext\u003c/code\u003e columns store the value in full; a Postgres \u003ccode\u003evarchar(n)\u003c/code\u003e column bounds it independently and is not exposed.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "A resource attribute must carry a `max_length` constraint (or an equivalent `string_length` validation) fed from client input, and the data layer must impose no independent size limit of its own. The ETS and Mnesia data layers and Postgres `text` columns store the value in full; a Postgres `varchar(n)` column bounds it independently and is not exposed."
}
],
"value": "A resource attribute must carry a max_length constraint (or an equivalent string_length validation) fed from client input, and the data layer must impose no independent size limit of its own. The ETS and Mnesia data layers and Postgres text columns store the value in full; a Postgres varchar(n) column bounds it independently and is not exposed."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.33.0",
"versionStartIncluding": "0.10.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "reporter",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Validation of Specified Quantity in Input vulnerability in ash-project ash allows an attacker to store a value of arbitrary size in an attribute whose length constraint should bound it.\u003c/p\u003e\n\u003cp\u003eAsh measures string length with Elixir\u0027s \u003ccode\u003eString.length/1\u003c/code\u003e, which counts Unicode graphemes, in the \u003ccode\u003emax_length\u003c/code\u003e and \u003ccode\u003emin_length\u003c/code\u003e constraints of \u003ccode\u003eAsh.Type.String\u003c/code\u003e (\u003ccode\u003eapply_constraints/2\u003c/code\u003e in \u003ccode\u003elib/ash/type/string.ex\u003c/code\u003e), in \u003ccode\u003eAsh.Resource.Validation.StringLength\u003c/code\u003e, and in the \u003ccode\u003estring_length\u003c/code\u003e expression function. A grapheme carries an unbounded number of combining marks, so a base character followed by a million combining acute accents is one grapheme and megabytes of data, and satisfies \u003ccode\u003emax_length: 2\u003c/code\u003e. Where the data layer imposes no independent limit (ETS, Mnesia, or a Postgres \u003ccode\u003etext\u003c/code\u003e column) the whole value is persisted, so an attacker can write an entire request body into an attribute declared with a small maximum and grow storage without bound.\u003c/p\u003e\n\u003cp\u003eThe counting unit also disagrees with the storage layer, which counts codepoints rather than graphemes, so a value accepted by the constraint can still be rejected or truncated by the column. A Postgres \u003ccode\u003evarchar(n)\u003c/code\u003e column bounds the value itself and is not exposed.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash: from 0.10.0 before 3.33.0.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Improper Validation of Specified Quantity in Input vulnerability in ash-project ash allows an attacker to store a value of arbitrary size in an attribute whose length constraint should bound it.\n\nAsh measures string length with Elixir\u0027s `String.length/1`, which counts Unicode graphemes, in the `max_length` and `min_length` constraints of `Ash.Type.String` (`apply_constraints/2` in `lib/ash/type/string.ex`), in `Ash.Resource.Validation.StringLength`, and in the `string_length` expression function. A grapheme carries an unbounded number of combining marks, so a base character followed by a million combining acute accents is one grapheme and megabytes of data, and satisfies `max_length: 2`. Where the data layer imposes no independent limit (ETS, Mnesia, or a Postgres `text` column) the whole value is persisted, so an attacker can write an entire request body into an attribute declared with a small maximum and grow storage without bound.\n\nThe counting unit also disagrees with the storage layer, which counts codepoints rather than graphemes, so a value accepted by the constraint can still be rejected or truncated by the column. A Postgres `varchar(n)` column bounds the value itself and is not exposed.\n\nThis issue affects ash: from 0.10.0 before 3.33.0."
}
],
"value": "Improper Validation of Specified Quantity in Input vulnerability in ash-project ash allows an attacker to store a value of arbitrary size in an attribute whose length constraint should bound it.\n\nAsh measures string length with Elixir\u0027s String.length/1, which counts Unicode graphemes, in the max_length and min_length constraints of Ash.Type.String (apply_constraints/2 in lib/ash/type/string.ex), in Ash.Resource.Validation.StringLength, and in the string_length expression function. A grapheme carries an unbounded number of combining marks, so a base character followed by a million combining acute accents is one grapheme and megabytes of data, and satisfies max_length: 2. Where the data layer imposes no independent limit (ETS, Mnesia, or a Postgres text column) the whole value is persisted, so an attacker can write an entire request body into an attribute declared with a small maximum and grow storage without bound.\n\nThe counting unit also disagrees with the storage layer, which counts codepoints rather than graphemes, so a value accepted by the constraint can still be rejected or truncated by the column. A Postgres varchar(n) column bounds the value itself and is not exposed.\n\nThis issue affects ash: from 0.10.0 before 3.33.0."
}
],
"impacts": [
{
"capecId": "CAPEC-153",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-153 Input Data Manipulation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1284",
"description": "CWE-1284 Improper Validation of Specified Quantity in Input",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-05T17:16:16.722Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-cwjv-574p-59f6"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82752.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82752"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash/commit/a64cab49b8886503e6b7c7b211d83c475aac48ca"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash/commit/cdbf4c4da6bda5f6f139078f01a64320b595216d"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Ash string length constraints count graphemes, so a combining-mark string of any size passes max_length"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82752",
"datePublished": "2026-09-05T17:16:16.722Z",
"dateReserved": "2026-08-31T01:00:10.817Z",
"dateUpdated": "2026-09-08T18:20:03.503Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}