CVE-2026-82739lowCWE-209

CVE-2026-82739: low-severity vulnerability in ash-project ash

Ash.Resource.Validation.Confirm leaks a confirmed field's stored value in the atomic mismatch error

Published

Follow this CVE+ Monitor ash+ Monitor ash

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 2.1epss 0.2%
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash discloses the stored value of a confirmed field to an actor who fails its confirmation check. Ash.Resource.Validation.Confirm's atomic implementation (atomic/2 in lib/ash/resource/validation/confirm.ex) built the mismatch error with its value set to the field being confirmed. When the actor supplies only the confirmation argument and not the field itself, value resolves through atomic_ref/2 to the field's current stored value, so the mismatch error echoes that stored value back to the actor. Against a confirmation guarding a sensitive attribute, an actor can submit a deliberately wrong confirmation and read the real value from the returned error. The fix reports the actor-supplied confirmation in the error instead of the stored field value. This issue affects ash: from 2.17.20 before 3.32.2.
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
ash-project · ash
Related CVEs — ash-project ash

In the same product, most dangerous first.

CVE-2025-48044HIGHAuthorization bypass when bypass policy condition evaluates to trueEPSS 0.7%CVE-2026-67579HIGHFilter expression injection via forged keyset pagination cursor in AshEPSS 0.6%CVE-2026-34593HIGHAsh Framework: Ash.Type.Module.cast_input/2 atom exhaustion via unchecked Module.concat allows BEAM VM crashEPSS 0.4%CVE-2026-86338MEDIUMAsh field policies do not filter-nil forbidden calculations and aggregates, enabling an information-disclosure oracleEPSS 0.4%CVE-2025-48043HIGHBypass and runtime policies that can never pass may be incorrectly applied in filter authorizationEPSS 0.4%CVE-2026-69659MEDIUMMemory exhaustion via unbounded deserialization of keyset pagination cursors in Ash.Page.KeysetEPSS 0.4%