CVE-2026-82722
HighCVSS 8.3Summary
A vulnerability in ash_admin allows any client that can reach the admin LiveView to exhaust the BEAM atom table and crash the entire node. Two LiveView event handlers intern atoms from unvalidated client input, and atoms are never garbage collected, leading to a crash.
Risk Assessment
An attack can crash the entire node, causing downtime for all applications on that node. This can lead to service unavailability and potential data loss.
Recommendation
It is recommended to upgrade ash_admin to version 1.3.1 or later, which includes a fix for this issue.
Other vulnerabilities in ash_admin
See all- CVE-2026-82681Low
A vulnerability in ash_admin allows an attacker who controls a record's string primary key to rewrite the target of AshAdmin's row-action links. Links are built via raw string interpolation without URL-encoding, enabling parameter injection and redirecting admins to unintended actions.
- CVE-2026-82673High
A Path Traversal vulnerability in ash_admin allows writing attacker-controlled bytes to arbitrary paths on the server. The browser-supplied filename is not sanitized, allowing writes outside the temporary directory.
- CVE-2026-81853Low
A vulnerability in ash_admin allows authorization bypass through user-controlled keys, turning a record-lookup URL into an equality oracle over sensitive attributes. The primary key decoding does not verify that returned fields are actual primary key fields, enabling brute-force of sensitive values.
- CVE-2026-81852Low
A vulnerability in ash_admin involves the use of a hardcoded, publicly known CSP nonce, defeating nonce-based Content-Security-Policy protection. The default nonce is a constant known from the repository and is not rotated, allowing its reuse to run unauthorized scripts.
- CVE-2026-77850High
A Stored Cross-site Scripting vulnerability in ash_admin executes attacker-supplied record content as script in an administrator's browser. The RelationshipField and ManagedRelationshipSelectField components render labels without proper escaping.
- CVE-2026-75757High
A vulnerability in ash_admin relying on cookies without validation and integrity checking allows an attacker controlling a sibling subdomain to rebind an admin's session to a different actor, tenant, or authorization mode. Cookies are matched using an unanchored regular expression.
Original NVD description (English source)
Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_admin lets any client that can reach the admin LiveView exhaust the BEAM atom table and crash the entire node. Two LiveView event handlers interned atoms from unvalidated client input: AshAdmin.PageLive's set_actor built modules from the resource/domain payload with Module.concat/1, and AshAdmin.Components.Resource.Show's calculate converted every submitted form key with String.to_atom/1. Atoms are never garbage collected and the table is capped, so flooding either event with random names mints a new atom per request until the VM aborts, taking down every application on the node. The fix resolves the submitted resource/domain against the known shown resources and maps calculation keys to declared arguments, so no client-supplied string is interned. This issue affects ash_admin: from 0.1.0 before 1.3.1.