Ash Project: Ten Vulnerabilities Including High-Severity Flaws Disclosed Together
Key findings • Ten vulnerabilities disclosed for Ash Project components between 2026-09-07 and 2026-09-08. • Two high-severity flaws include resource exhaustion in the OAuth2 server and arbit…
Key findings
- Ten vulnerabilities disclosed for Ash Project components between 2026-09-07 and 2026-09-08.
- Two high-severity flaws include resource exhaustion in the OAuth2 server and arbitrary file read in the Lua module.
- Multiple vulnerabilities affect the Ash Project's OAuth2 server, including SSRF and authentication bypass.
- Low-severity issues impact terminal control sequence handling and package installation prompts.
- Users are urged to update to the latest versions to patch these vulnerabilities.
On September 7-8, 2026, a batch of ten vulnerabilities was disclosed for the Ash Project, a suite of Elixir libraries. The disclosures, spanning two hours, include two high-severity flaws, five medium-severity flaws, and three low-severity flaws. The vulnerabilities affect various components of the Ash Project, including its authentication, Lua, and double-entry bookkeeping modules. The most critical issues include an authentication bypass in the OAuth2 server that could lead to resource exhaustion and an arbitrary file read vulnerability in the Lua module.
The Ash Project's OAuth2 server component is particularly affected, with several vulnerabilities disclosed. CVE-2026-82753, a high-severity flaw, allows an unauthenticated attacker to exhaust database storage and memory by exploiting the /authorize endpoint. CVE-2026-82757, a medium-severity Server-Side Request Forgery (SSRF) vulnerability, enables an attacker to force the server to connect to internal or loopback addresses by controlling a client metadata URL. Another medium-severity issue, CVE-2026-82758, involves improper authentication in the OAuth2 server, allowing unauthenticated attackers to register OAuth clients even when dynamic client registration is restricted. CVE-2026-82756, also medium-severity, permits an unauthenticated attacker to inject arbitrary authentication parameters into the WWW-Authenticate challenge header. Finally, CVE-2026-82755, a medium-severity vulnerability, could lead to a shared HTTP cache serving one tenant's OAuth discovery metadata to another tenant's clients. CVE-2026-82754, a medium-severity flaw, exposes state-changing OAuth endpoints under an unintended URL prefix, bypassing intended access controls.
Beyond the OAuth2 server, other Ash Project components are also impacted. CVE-2026-82586, a high-severity vulnerability in the ash_lua module, allows user-supplied Lua scripts to read sensitive attributes not included in the allow-list. In the igniter component, CVE-2026-82584, a low-severity flaw, could enable a malicious package publisher to forge the mix igniter.install confirmation prompt. Lastly, CVE-2026-81638, a low-severity vulnerability in ash_double_entry, relates to improper handling of alternate encoding, potentially allowing an attacker to submit different string spellings of the same identifier. CVE-2026-82710, a low-severity vulnerability in usage_rules, allows injection of terminal control sequences into the output of mix usage_rules.search_docs.
The Ash Project team has addressed these vulnerabilities. Users are advised to update to the latest versions to mitigate these risks. The disclosure of these vulnerabilities highlights the importance of regularly auditing and updating dependencies, especially in authentication and authorization systems.
This batch of vulnerabilities underscores the interconnectedness of security across different modules within a software project. The concentration of issues within the OAuth2 server component, in particular, warrants careful attention from developers relying on Ash Project for their authentication infrastructure. Users should prioritize applying patches and reviewing their configurations to prevent potential exploitation.
The timely disclosure and patching of these vulnerabilities by the Ash Project team are crucial for maintaining the security posture of applications utilizing these libraries. Continued vigilance and prompt updates are recommended for all users.