CVE-2026-81852: ash_admin Hardcoded CSP Nonce XSS Vulnerability

CVE-2026-81852 Overview

CVE-2026-81852 affects ash_admin, an administration interface for the Ash Framework in Elixir. The library shipped a hardcoded, publicly known Content-Security-Policy (CSP) nonce, defeating nonce-based CSP protection. When mounted without the :csp_nonce_assign_key option, AshAdmin.Router.ash_admin/2 defaulted image, style, and script nonces to the compile-time constant ash_admin-Ed55GFnX. AshAdmin.Layouts then wrote this literal value into inline <style> and <script> tags on every response. Applications that allow-listed the documented default in their CSP script-src directive could have inline script protections bypassed through any HTML-injection sink on an admin page. This weakness is categorized under [CWE-330: Use of Insufficiently Random Values].

Critical Impact
Attackers with an HTML-injection sink on an admin page can reuse the known nonce to execute inline scripts the CSP was meant to block.

Affected Products

ash-project ash_admin versions from 0.10.8 up to but not including 1.3.1
Elixir/Phoenix applications using Ash Framework administration UI
Deployments mounting ash_admin without an explicit :csp_nonce_assign_key

Discovery Timeline

2026-08-31 - CVE-2026-81852 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-81852

Vulnerability Analysis

The vulnerability stems from a design decision to ship a static default nonce value for backwards compatibility. AshAdmin.Layouts emits inline <script> and <style> tags containing a nonce attribute. Without an explicit CSP nonce assign key, the router used the literal constant ash_admin-Ed55GFnX on every request. Because this constant lives in the public repository and is never rotated, any allow-list entry referencing it becomes a permanent bypass path. An attacker who identifies an HTML-injection sink on an admin route can craft inline scripts using the known nonce. The CSP treats those scripts as trusted and executes them in the victim's browser session.

Root Cause

The library used a compile-time constant instead of a per-request cryptographically random value for the CSP nonce. Nonce-based CSP enforcement assumes the token is unpredictable to attackers. Publishing the nonce in source code eliminates that unpredictability entirely.

Attack Vector

Exploitation requires two conditions. First, the target application must allow-list the documented default nonce value in its CSP configuration. Second, an attacker must control an HTML-injection point rendered on an admin page. User interaction is required because the injected content executes in an authenticated admin session. The fix generates a fresh random nonce per request using :crypto.strong_rand_bytes/1.

elixir

   def render("app.css", _), do: @app_css
 
   def render("root.html", assigns) do
+    # A fresh random nonce per request, used for AshAdmin's own inline assets
+    # when the host app has not supplied a CSP nonce assign key.
+    assigns =
+      Map.put(assigns, :ash_admin_csp_nonce, Base.url_encode64(:crypto.strong_rand_bytes(18)))
+
     ~H"""
     <!DOCTYPE html>
     <html lang="en" phx-socket={live_socket_path(@conn)}>

Source: GitHub commit bc7a1cd

Detection Methods for CVE-2026-81852

Indicators of Compromise

Occurrences of the literal string ash_admin-Ed55GFnX in server responses, CSP headers, or application logs
Inline <script> or <style> tags on admin pages carrying the nonce="ash_admin-Ed55GFnX" attribute from untrusted content
Unexpected admin-page requests followed by outbound connections initiated from the browser context

Detection Strategies

Inventory Elixir dependencies for ash_admin versions between 0.10.8 and 1.3.0 using mix deps or SBOM tooling
Inspect application router configuration to confirm whether ash_admin/2 is invoked without a :csp_nonce_assign_key
Review deployed CSP headers for hardcoded allow-listing of the ash_admin-Ed55GFnX nonce value

Monitoring Recommendations

Log and alert on CSP violation reports originating from admin routes
Correlate authenticated admin sessions with anomalous inline script execution or unusual DOM activity
Track dependency drift so security advisories for Elixir packages trigger review workflows

How to Mitigate CVE-2026-81852

Immediate Actions Required

Upgrade ash_admin to version 1.3.1 or later, which generates a per-request random nonce
Remove any CSP allow-list entry referencing the ash_admin-Ed55GFnX constant
Configure :csp_nonce_assign_key in AshAdmin.Router.ash_admin/2 to point to your application's per-request nonce assign

Patch Information

The fix is delivered in ash_admin 1.3.1 via GitHub commit bc7a1cd. The patch replaces the static default with Base.url_encode64(:crypto.strong_rand_bytes(18)) generated per request. Full advisory details are available in GHSA-whfj-rrrp-j597 and the Erlang Ecosystem Foundation CNA record.

Workarounds

Supply the :csp_nonce_assign_key option pointing to a Plug that assigns a fresh random nonce on every request
Restrict access to ash_admin routes to trusted networks or authenticated administrators until patching completes
Audit admin page templates for HTML-injection sinks that could reflect user-controlled data into the DOM

bash

# Update ash_admin in mix.exs to the patched version
# {:ash_admin, "~> 1.3.1"}
mix deps.update ash_admin
mix deps.get