Ash Project: 25 Vulnerabilities Across Multiple Components Disclosed Together
Ash Project components (ash_phoenix, ash_admin, ash_ai, ash_graphql) impacted by 25 vulnerabilities disclosed Aug 30-31, 2026, ranging from Low to Critical severity.
Key findings
- 25 vulnerabilities disclosed across Ash Project components (ash_phoenix, ash_admin, ash_ai, ash_graphql, ash_cloak).
- Critical code injection vulnerability (CVE-2026-77956) in ash_ai allows arbitrary code execution.
- Multiple authorization bypasses and sensitive data exposure issues found across components.
- Resource exhaustion flaws in ash_admin and ash_graphql can lead to denial-of-service conditions.
- Simultaneous disclosure highlights a significant security posture review for Ash Project users.
On August 30-31, 2026, a significant batch of 25 vulnerabilities was disclosed across multiple components of the Ash Project's ecosystem, including ash_phoenix, ash_admin, ash_ai, and ash_graphql. These vulnerabilities range in severity from Low to Critical, with several High and Critical findings posing substantial risks to applications utilizing these frameworks. The disclosures highlight issues such as authorization bypass, sensitive information exposure, code injection, and resource exhaustion, underscoring the need for prompt attention from developers and administrators.
The vulnerabilities identified in ash_phoenix and ash_admin primarily revolve around authorization flaws and sensitive data leakage. CVE-2026-82724, a High severity vulnerability, arises from an incorrect authorization callback invocation with a nil tenant, bypassing tenant-scoped access checks. Similarly, CVE-2026-82725 and CVE-2026-81853, both Low severity, detail authorization bypasses through user-controlled keys, allowing attackers to filter across relationships or use record-lookup URLs as an oracle over private data. Sensitive information is leaked via error messages in CVE-2026-82727 (Low) and CVE-2026-81852 (Low) due to improper encoding or escaping and the use of a hardcoded CSP nonce, respectively. A critical path traversal vulnerability, CVE-2026-82673 (High), in ash_admin allows writing attacker-controlled bytes to arbitrary paths. Resource exhaustion is a concern with CVE-2026-82722 (High), where unvalidated client input can exhaust the BEAM atom table and crash the node. Stored XSS in CVE-2026-77850 (High) allows script execution in an administrator's browser, and CVE-2026-75757 (High) involves reliance on cookies without validation, enabling session hijacking.
The ash_ai component is affected by several critical and high-severity vulnerabilities. CVE-2026-77956, a Critical vulnerability, permits remote, unauthenticated clients to execute arbitrary Elixir code by evaluating prompt content through EEx.eval_string/2. High severity flaws include CVE-2026-82564, an authorization bypass allowing manipulation of records via identity-configured tools, and CVE-2026-81315, an origin validation error that bypasses DNS-rebinding protection. Sensitive information disclosure is also present in CVE-2026-82579 (Medium) and CVE-2026-82564 (High), where error messages and tool arguments respectively leak provider request state and credentials. An infinite loop vulnerability, CVE-2026-82579 (Medium), can be triggered by influencing model output, leading to unbounded repeated model requests.
In ash_graphql, the disclosed vulnerabilities primarily concern data exposure and authorization issues within subscription and query handling. CVE-2026-81643 (Low) and CVE-2026-80223 (High) allow unauthorized access to GraphQL subscription payloads, with the latter enabling authenticated subscribers in one tenant to receive data from another. CVE-2026-82367 (Low) exposes data elements to incorrect sessions, and CVE-2026-81636 (High) bypasses query complexity limits, potentially leading to unbounded database reads. CVE-2026-81633 (Medium) involves improper input validation, allowing unauthenticated clients to crash nodes with malformed relay IDs. CVE-2026-78693 (Medium) allows reading internal field names that were intended to be redacted.
Finally, ash_cloak is impacted by CVE-2026-81322 (Low), which exposes sensitive information from encrypted fields through logs and error reports, and CVE-2026-81319 (Medium), a deserialization vulnerability that can lead to node crashes via atom creation or decompression bombs during decryption.
The broad range of vulnerabilities across the Ash Project's components necessitates a thorough review of affected applications. Users are advised to consult the specific advisories for each CVE and apply patches or mitigations as recommended by the Ash Project team. The simultaneous disclosure of these issues suggests a coordinated effort to address a significant security posture within the Ash ecosystem.
The vulnerabilities were disclosed on August 30-31, 2026. The affected components include ash_phoenix, ash_admin, ash_ai, and ash_graphql. Key issues include authorization bypasses, sensitive data exposure, code injection, and resource exhaustion.
- Multiple authorization bypass vulnerabilities across ash_phoenix, ash_admin, and ash_ai.
- Critical code injection flaw in ash_ai (CVE-2026-77956) allows arbitrary Elixir code execution.
- Sensitive information leakage via error messages and logs in ash_phoenix, ash_admin, ash_ai, and ash_graphql.
- Resource exhaustion vulnerabilities in ash_admin and ash_graphql can lead to node crashes or unbounded reads.
- GraphQL subscription data exposure and bypass of security controls in ash_graphql.
- CVE-2026-81319 in ash_cloak allows for deserialization attacks leading to node crashes.