VYPR
Vypr IntelligenceAI-generatedSep 1, 2026· 22 CVEs

Ash Project: 25 Vulnerabilities Including Critical Code Injection Disclosed Together

Ash Project: 25 vulnerabilities, including critical code injection and authorization bypasses, disclosed across multiple components.

Key findings

  • 25 vulnerabilities disclosed across Ash Project components, ranging from Low to High severity.
  • Critical code injection (CVE-2026-77956) in ash_ai allows arbitrary code execution.
  • Multiple authorization bypasses and sensitive data exposure issues found across components.
  • Resource exhaustion flaws in ash_admin and ash_graphql can lead to denial-of-service conditions.
  • The ash_ai component is particularly affected by critical and high-severity flaws.
  • Simultaneous disclosure highlights a significant security posture review for Ash Project users.

On August 31, 2026, a significant batch of 25 vulnerabilities was disclosed across multiple components of the Ash Project's ecosystem, including ash_phoenix, ash_admin, ash_ai, and ash_graphql. These vulnerabilities range in severity from Low to Critical, with several high-severity flaws in the ash_ai component posing the most immediate risk to users. The coordinated disclosure, spanning from August 31 to September 1, 2026, highlights a broad security review of the Ash framework.

The ash_ai component, which facilitates AI-driven interactions, is particularly affected. A critical code injection vulnerability, CVE-2026-77956, allows remote, unauthenticated clients to execute arbitrary Elixir code by evaluating untrusted prompt content. This is compounded by an authorization bypass in CVE-2026-82564, enabling callers of identity-configured tools to modify or delete records they should not have access to, potentially affecting all rows in a table. Additionally, CVE-2026-75760 discloses sensitive provider request state and credentials in user-facing validation errors, while CVE-2026-81315 presents an origin validation error that can bypass DNS-rebinding protection and allow cross-site requests to a user's local MCP server. CVE-2026-82579 introduces a loop with an unreachable exit condition, allowing an attacker to hang the tool loop and trigger unbounded, repeated model requests, leading to denial-of-service.

Beyond ash_ai, other Ash components also suffer from authorization and access control issues. CVE-2026-82747, a medium-severity Incorrect Authorization vulnerability, permits access to records that a runtime read policy should deny. Similarly, CVE-2026-82749 widens a relationship's parent scoping filter to match unintended records when the parent field cannot be resolved. CVE-2026-82748 describes an authorization issue where an aggregate is authorized under one read action but computed under another, potentially running with mismatched policies. A Missing Authorization vulnerability, CVE-2026-82746, allows actors to update records forbidden by resource policies through the Ash.update_many/4 function when an atomic strategy is employed. CVE-2026-82580, another sensitive information disclosure, exposes internal error text to chat users within ash_ai.

Several vulnerabilities relate to resource consumption and input validation. CVE-2026-82743, a low-severity issue, allows a slow asynchronous read to consume a scheduler thread at full CPU. CVE-2026-82744, a "Not Failing Securely" vulnerability, skips an Ash.Reactor change when its guard raises, preventing intended changes from executing. CVE-2026-82745, an Improper Access Control flaw, permits a create action to overwrite an existing record when using ETS or Mnesia data layers, as they do not enforce primary-key uniqueness on insert. CVE-2026-82735, an Uncontrolled Resource Consumption vulnerability, allows an attacker to force an expensive regular expression to run on input that should have been rejected by a length constraint. CVE-2026-82738, an Improper Input Validation issue, permits an attacker to persistently deny reads of a record by storing a non-version-7 UUID in an Ash.Type.UUIDv7 attribute. CVE-2026-82737, an Integer Overflow or Wraparound vulnerability, allows an attacker to corrupt a stored vector by submitting one with more than 65,535 elements, potentially crashing later reads.

Further input validation weaknesses were identified. CVE-2026-82741, an Improper Validation of Specified Type of Input, allows an attacker to confuse the stored type tag of an Ash.Type.Union value, bypassing validation and authorization. CVE-2026-82740, an Improper Input Validation vulnerability, fails to enforce outer array constraints on doubly-nested {:array, {:array, type}} attributes. CVE-2026-82736, an Incorrect Behavior Order vulnerability, allows an attacker to store a case-insensitive string that violates its length or match constraints by validating after canonicalization. CVE-2026-82734, an Improper Validation of Specified Quantity in Input, permits an attacker to submit non-finite decimal values that bypass numeric bounds. Finally, CVE-2026-82739, a Generation of Error Message Containing Sensitive Information vulnerability, discloses the stored value of a confirmed field to an actor who fails its confirmation check.

The simultaneous disclosure of these 25 vulnerabilities underscores the importance for Ash Project users to conduct a thorough security posture review. Users are strongly advised to update to patched versions as soon as possible, paying particular attention to the critical and high-severity flaws in the ash_ai component. The breadth of issues across multiple components suggests a need for ongoing vigilance and prompt patching to mitigate risks of unauthorized access, data corruption, and code execution.

The vulnerabilities were disclosed by multiple sources, with a significant portion detailed by Vypr Intelligence. The affected versions and specific patch details are available in the respective Ash Project advisories.

The batch of vulnerabilities spans multiple components within the Ash Project, including ash_ai, ash_phoenix, ash_admin, ash_graphql, and ash_cloak. The disclosure occurred between August 31 and September 1, 2026.

The critical code injection vulnerability (CVE-2026-77956) in ash_ai allows arbitrary code execution. Multiple authorization bypasses and sensitive data exposure issues were found across components. Resource exhaustion flaws in ash_admin and ash_graphql can lead to denial-of-service conditions. The simultaneous disclosure highlights a significant security posture review for Ash Project users. The vulnerabilities range in severity from Low to High. The ash_ai component is particularly affected by critical and high-severity flaws. The disclosure window for this batch of vulnerabilities was August 31 to September 1, 2026. The Ash Project is the vendor and Ash is the product. CVE-2026-75760, CVE-2026-77956, CVE-2026-81315, CVE-2026-82564, CVE-2026-82579, CVE-2026-82580, CVE-2026-82734, CVE-2026-82735, CVE-2026-82736, CVE-2026-82737, CVE-2026-82738, CVE-2026-82739, CVE-2026-82740, CVE-2026-82741, CVE-2026-82742, CVE-2026-82743, CVE-2026-82744, CVE-2026-82745, CVE-2026-82746, CVE-2026-82747, CVE-2026-82748, CVE-2026-82749

AI-written article. Grounded in 22 CVE records listed below.