CVE-2026-82727: ash_phoenix Information Disclosure Flaw

CVE-2026-82727 Overview

CVE-2026-82727 is an information disclosure vulnerability in the ash_phoenix library for the Elixir Ash framework. The flaw exists in AshPhoenix.Form.Auto when building union sub-forms. When a submitted _union_type value does not match a configured type, the library raises an exception whose message embeds the entire untrusted parameter map via inspect(params, pretty: true). Because the library constructs the message directly, Phoenix's config :phoenix, :filter_parameters never redacts it. Any secrets submitted in the same form, such as passwords or tokens, leak into logs, crash reports, and the development error page. The issue is classified as [CWE-209] Generation of Error Message Containing Sensitive Information.

Critical Impact
An attacker who controls form submission can force sensitive parameters into application logs and error tracking systems by submitting an invalid _union_type value alongside credentials.

Affected Products

ash_phoenix versions >= 1.2.17 and < 2.3.25
Elixir/Phoenix applications using AshPhoenix.Form.Auto with union form fields
Any deployment forwarding exception messages to logs, Sentry-style error trackers, or the Phoenix dev error page

Discovery Timeline

2026-08-31 - CVE-2026-82727 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-82727

Vulnerability Analysis

The defect lives in the determine_type/3 function inside lib/ash_phoenix/form/auto.ex. When AshPhoenix.Form.Auto builds a sub-form for a union type, it inspects the submitted _union_type string against the configured type list in constraints[:types]. If no match is found, the raise sites format an error message using inspect(params, pretty: true), embedding the full raw param map. The message also inspects the internal constraints[:types] structure, which can expose schema internals.

Because the exception message is produced inside the library, Phoenix's parameter filtering configured through config :phoenix, :filter_parameters does not apply. Filtered fields such as password, secret, and token are redacted only in the request logger. Any downstream consumer of the raised exception, including Logger, Sentry, AppSignal, and Phoenix's dev error view, receives the unredacted values.

Root Cause

The root cause is unsafe error construction. Library code assumed the parameter map was safe to include in diagnostics but never sanitized it. The message additionally dumped internal constraints, widening the disclosure surface.

Attack Vector

An authenticated or unauthenticated user submits a form containing a union field with a bogus _union_type value alongside sensitive parameters, for example %{"_union_type" => "nope", "password" => "hunter2"}. The library raises with the full map inspected verbatim, which is then written to log aggregation and crash-reporting pipelines that operators typically consider trusted.

text

     end
   end
 
-  defp determine_type(constraints, _data, %{"_union_type" => union_type} = params) do
+  defp determine_type(constraints, _data, %{"_union_type" => union_type}) do
     constraints[:types]
     |> Enum.find(fn {key, _value} ->
       to_string(key) == union_type

Source: GitHub commit 0c1775c. The patch stops binding params in the function head and rewrites the raise sites to report only the offending _union_type string and the list of valid type names.

Detection Methods for CVE-2026-82727

Indicators of Compromise

Log entries or crash reports containing raised messages that include inspect-formatted maps with plaintext values for keys normally listed in config :phoenix, :filter_parameters.
Exception stack traces originating from AshPhoenix.Form.Auto.determine_type/3 that reference an unknown _union_type.
Repeated form submissions containing _union_type values that do not match any configured union member.

Detection Strategies

Grep centralized logs and error-tracking backends for the substring _union_type in raised exceptions and correlate with keys such as password, token, api_key, or secret in the same message.
Inventory Elixir dependencies with mix deps.tree | grep ash_phoenix and flag any version in the range >= 1.2.17, < 2.3.25.
Add static-analysis rules to CI that reject calls to inspect/2 on request parameter maps inside raised exception messages.

Monitoring Recommendations

Route Phoenix application logs and Sentry/AppSignal events into a security data lake and alert when exception messages contain filtered parameter keys in cleartext.
Enable rate-based alerts on AshPhoenix.Form.Auto exceptions to identify enumeration or probing behavior against union form endpoints.
Rotate any credentials or tokens observed in historical logs and revoke associated sessions.

How to Mitigate CVE-2026-82727

Immediate Actions Required

Upgrade ash_phoenix to version 2.3.25 or later and redeploy affected Phoenix applications.
Purge or truncate historical logs and error-tracker events that contain leaked parameters, and rotate any exposed secrets.
Audit all AshPhoenix.Form.Auto union definitions and confirm the fixed version is loaded with mix deps.get && mix deps.compile ash_phoenix.

Patch Information

The fix is committed in ash-project/ash_phoenix commit 0c1775c and tracked in GitHub Security Advisory GHSA-5xf4-hgcq-xw7v. The patched release surfaces only the offending _union_type string and the list of configured type names, dropping both the params and constraints[:types] dumps. Additional detail is available in the Erlang Ecosystem Foundation CNA advisory and OSV entry EEF-CVE-2026-82727.

Workarounds

Wrap union sub-form handling with a try/rescue that scrubs any raised message before it reaches Logger or an error tracker.
Configure your error-tracking client to drop or redact exception messages from AshPhoenix.Form.Auto until the upgrade is deployed.
Restrict access to the Phoenix development error page by ensuring config :phoenix, :debug_errors is set to false in production.

bash

# mix.exs
# Pin to a patched release
{:ash_phoenix, "~> 2.3.25"}

# Then apply the update
mix deps.update ash_phoenix
mix deps.get
mix compile --force