CVE-2026-82722: ash_admin Atom Table Exhaustion DoS Vulnerability

CVE-2026-82722 Overview

CVE-2026-82722 is a resource exhaustion vulnerability in the ash_admin library for the Ash Framework on Elixir. Two LiveView event handlers interned atoms directly from unvalidated client input, allowing any client that can reach the admin LiveView to exhaust the BEAM virtual machine's atom table. Because atoms are never garbage collected and the table is capped, a flood of randomized names crashes the entire Erlang node, taking down every application co-located on it. The flaw is classified under CWE-770 (Allocation of Resources Without Limits or Throttling). It affects ash_admin versions from 0.1.0 before 1.3.1.

Critical Impact
An authenticated client with access to the admin LiveView can crash the entire BEAM node, causing denial of service for every application running on it.

Affected Products

ash_admin versions >= 0.1.0 and < 1.3.1
Elixir applications embedding AshAdmin.PageLive
Elixir applications embedding AshAdmin.Components.Resource.Show

Discovery Timeline

2026-08-31 - CVE-2026-82722 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-82722

Vulnerability Analysis

The vulnerability stems from unrestricted atom creation triggered by client-supplied strings. In the BEAM virtual machine, atoms are stored in a global, non-garbage-collected table with a fixed upper bound (default 1,048,576 entries). When the table fills, the VM aborts. Attackers exploit this by sending repeated LiveView events containing random module names or form keys, each of which mints a new atom until the node terminates.

Two distinct code paths were affected. In AshAdmin.PageLive, the set_actor handler passed the client-supplied resource and domain values to Module.concat/1, which interns the resulting module name as an atom. In AshAdmin.Components.Resource.Show, the calculate handler iterated over every submitted form key and called String.to_atom/1 on each attribute name.

Because the admin LiveView is often reachable by any authenticated user, this vector requires only low privileges and no user interaction to abuse.

Root Cause

The root cause is the use of atom-interning functions (Module.concat/1 and String.to_atom/1) on strings that originate from client-controlled LiveView payloads. Neither handler validated inputs against a known allow-list of resources, domains, or declared calculation arguments before interning.

Attack Vector

An attacker with network access to the admin LiveView sends a stream of set_actor or calculate events with randomly generated resource, domain, or calculation-argument names. Each request adds new entries to the atom table until BEAM aborts the node.

elixir

# Security patch in lib/ash_admin/components/resource/show.ex
# Removed unsafe String.to_atom/1 conversion of client keys

     {:noreply, assign(socket, :calculations, calculations)}
   end
 
-  # sobelow_skip ["DOS.StringToAtom"]
   def handle_event("calculate", %{"calculation" => calculation} = event, socket) do
     record = socket.assigns.record
     domain = socket.assigns.domain
 
-    arguments =
-      event
-      |> Map.get(calculation, [])
-      |> Enum.map(fn {attr, value} -> {String.to_atom(attr), value} end)
-      |> Enum.reject(fn {_, v} -> v in ["", nil] end)
-
-    calculation = String.to_existing_atom(calculation)

Source: GitHub Commit 731dffa

The patch replaces String.to_atom/1 with a lookup against declared calculation arguments and resolves the resource and domain in set_actor against the already-loaded set of shown resources, ensuring no client-supplied string is ever interned.

Detection Methods for CVE-2026-82722

Indicators of Compromise

Rapid growth of the BEAM atom count reported by :erlang.system_info(:atom_count) on nodes running ash_admin.
Repeated LiveView set_actor or calculate events with unusual, high-entropy resource, domain, or attribute names.
Unexpected node crashes with the message no more index entries in atom_tab in the Erlang crash dump.

Detection Strategies

Instrument the application to periodically emit :erlang.system_info(:atom_count) and alert when the value grows abnormally over short windows.
Enable Phoenix LiveView telemetry and log event payloads for set_actor and calculate handlers to identify sources sending high-cardinality inputs.
Correlate WAF or reverse-proxy logs for repeated POST/WebSocket traffic to admin LiveView routes from a single client.

Monitoring Recommendations

Track BEAM VM metrics including atom count, atom table utilization, and node uptime through your observability stack.
Alert on any unclean node shutdown in production hosts running ash_admin.
Log and rate-limit access to /admin LiveView routes at the edge.

How to Mitigate CVE-2026-82722

Immediate Actions Required

Upgrade ash_admin to version 1.3.1 or later in mix.exs and redeploy.
Restrict network access to the admin LiveView to trusted operators only, using authentication and network-level allow-lists.
Audit any custom LiveView handlers in the application for calls to String.to_atom/1, Module.concat/1, or List.to_atom/1 on client input.

Patch Information

The fix is available in ash_admin version 1.3.1. See the GitHub Security Advisory GHSA-wcr6-9rrw-5jhv and the upstream commit 731dffa. Additional detail is documented in the Erlang Ecosystem Foundation CNA advisory and OSV entry EEF-CVE-2026-82722.

Workarounds

If upgrading immediately is not possible, remove or gate the ash_admin router mount so it is unreachable from untrusted networks.
Place the admin LiveView behind a reverse proxy that enforces per-source rate limits on WebSocket messages.
Replace unsafe atom-interning calls in local forks with String.to_existing_atom/1 combined with allow-list validation.

bash

# Update mix.exs to require the fixed version
# {:ash_admin, "~> 1.3.1"}
mix deps.update ash_admin
mix deps.get
mix compile