TI-2026-57059 Aliases CVE-2026-82741

Ash.Type.Union with :map_with_tag does not force the tag on dump, enabling tag confusion

MEDIUM 44CWE-1287Published 2026-09-01 · Updated 2026-09-01

Key facts

Attack vector: Local
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: Present
Impact type: —
Confidentiality · integrity · availability: None · Low · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Improper Validation of Specified Type of Input vulnerability in ash-project ash lets an attacker confuse the stored type tag of an Ash.Type.Union value that uses storage: :map_with_tag, bypassing that member's validation and any tag-based authorization. For a union with storage: :map_with_tag, each member is identified in storage by a configured tag and tag_value. Ash.Type.Union.dump_to_native/2 (lib/ash/type/union.ex) did not force the configured tag when writing the value, so a tag carried in the submitted value was persisted verbatim. An attacker can therefore store a value whose data belongs to one member but whose tag names a different member. On read the value is re-selected by its tag and treated as the incompatible member (a type confusion), bypassing the real member's constraints and any logic or policy that branches on the union tag. The fix drops any incoming tag and forces the configured tag value on dump. This issue affects ash: from 2.14.18 before 3.32.2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00189 8th percentileScored 2026-11-07

Fix Fixed ash (ash-project): 3.32.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
ash-project	ash	2.14.18 to before 3.32.2	3.32.2	Patch available	CNA

ash Vendorash-project Affected 2.14.18 to before 3.32.2 Fixed in 3.32.2 Patch available CNA

CPE names CNA · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:ash-project:ash::::::::	—	—	—

cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

Fix · CNA ash (ash-project) Fixed in 3.32.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-09-01
ash-project ash 3.32.2
16 records Highest priority Priority MEDIUM 15 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2026-57067 Incorrect authorization in ash-project ashPriority MEDIUM 60
- TI-2026-57065 Ash.Policy.Authorizer returns records denied by a runtime read policy to any actorPriority MEDIUM 60
- TI-2026-57064 Ash.update_many/4 atomic path skips resource policy authorization, allowing updates to forbidden recordsPriority MEDIUM 60
Show all 16 records →

Timeline

2026-10-02 Threatist record created from CVE-2026-82741

References

Patch 1

https://github.com/ash-project/ash/commit/8dbdaecd0f115f52e7c3f9a3e798617d6fbf5f7d

Advisory 1

https://github.com/ash-project/ash/security/advisories/GHSA-2mmm-gc86-7jgg

Other 2

TI-2026-56298 Query-complexity limit bypass via first/last pagination arguments in AshGraphql enables denial of service CVSS 4.0HIGH 8.7
TI-2026-52572 Unbounded atom creation from client-supplied RPC field names in AshTypescript field formatter CVSS 4.0HIGH 8.7
TI-2026-57010 Path traversal in AshAdmin file uploads via unsanitized client filename CVSS 4.0HIGH 8.3
TI-2026-26840 Ash Framework: Ash.Type.Module.cast_input/2 atom exhaustion via unchecked Module.concat allows BEAM VM crash CVSS 4.0HIGH 8.2
TI-2026-54252 EEx template evaluation of prompt content in AshAi enables remote code execution CVSS 4.0HIGH 8.9
TI-2026-54208 Stored XSS in AshAdmin relationship typeahead via unescaped label_field content CVSS 4.0HIGH 8.4

See all 90 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences