CVE-2026-82736: Ash-Project Ash Information Disclosure

CVE-2026-82736 Overview

CVE-2026-82736 is a validate-before-canonicalize flaw [CWE-180] in the ash-project/ash Elixir framework. The Ash.Type.CiString.apply_constraints/2 function validates the max_length, min_length, and match constraints against the raw submitted string. The type then case-folds the value before storage and comparison. Because validation runs before folding, an attacker can submit a value whose folded form violates a constraint while the original form passes. The stored value then fails to match the constraint the application intended to enforce.

Critical Impact
An attacker can persist case-insensitive string values that violate declared min_length, max_length, or match constraints, undermining data integrity assumptions in downstream code.

Affected Products

ash-project/ash versions from 1.29.0-rc0 up to (but not including) 3.32.2
Elixir applications using Ash.Type.CiString with constraint enforcement
Ash resources relying on match patterns for case-sensitive validation

Discovery Timeline

2026-09-01 - CVE-2026-82736 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-82736

Vulnerability Analysis

The vulnerability lives in lib/ash/type/ci_string.ex. Ash.Type.CiString represents a case-insensitive string. The type stores the value in a canonical case-folded form based on the casing constraint. Validation of max_length, min_length, and match originally ran against the value as submitted, not the folded form. This ordering breaks the invariant that constraints hold for the stored representation.

A match regex requiring uppercase characters illustrates the flaw. An uppercase input passes validation, but the type folds the value to lowercase before storage. The persisted value then fails the same regex the resource declared. Similar bypasses apply to length checks when folding changes character width, such as with special Unicode case mappings.

Root Cause

The root cause is incorrect behavior order: validation ran against a pre-canonical form while storage used the canonical form. This mismatch is the exact pattern described by [CWE-180: Incorrect Behavior Order: Validate Before Canonicalize]. Any check that depends on the final stored representation must occur after canonicalization.

Attack Vector

Exploitation requires local access to an application that accepts user-controlled input into an Ash resource attribute typed as Ash.Type.CiString. The attacker crafts a value whose case-folded form violates the declared constraint. Because the flaw affects data at rest rather than execution flow, impact is limited to integrity of stored data.

text

   def apply_constraints(nil, _), do: {:ok, nil}
 
   def apply_constraints(value, constraints) do
+    value = casefold(value, constraints[:casing])
+
     {value, errors} =
       return_value(
         Keyword.get(constraints, :allow_empty?, false),

Source: GitHub Commit d8320b012. The patch case-folds the value at the start of apply_constraints/2 so all constraint checks operate on the form actually written to storage.

Detection Methods for CVE-2026-82736

Indicators of Compromise

Records in resources using Ash.Type.CiString whose stored value does not match the declared match regex.
Stored strings whose length falls outside the declared min_length or max_length after case-folding.
Application logs showing successful create or update actions that produced values later rejected by re-validation.

Detection Strategies

Run a database audit query against columns backed by Ash.Type.CiString and compare each value against the resource's declared constraints.
Add a post-load validation pass in staging that re-applies apply_constraints/2 and flags mismatches.
Review dependency manifests (mix.exs, mix.lock) for ash versions between 1.29.0-rc0 and 3.32.2.

Monitoring Recommendations

Track constraint violation errors emitted by Ash actions and alert on unexpected drops that may indicate bypasses.
Monitor for input payloads containing characters with non-trivial Unicode case mappings against endpoints backed by Ash resources.
Include ash in software composition analysis (SCA) scans and alert on installed versions below 3.32.2.

How to Mitigate CVE-2026-82736

Immediate Actions Required

Upgrade ash to version 3.32.2 or later in mix.exs and run mix deps.update ash.
Audit existing Ash.Type.CiString columns for values that violate declared constraints and remediate affected records.
Re-run resource validations across historical data to surface records persisted during the vulnerable window.

Patch Information

The fix is delivered in ash3.32.2 via commit d8320b0127c8ef453679d70e5dd23a9506951d21. It calls casefold(value, constraints[:casing]) at the top of apply_constraints/2 so min_length, max_length, and match checks operate on the stored form. See the GitHub Security Advisory GHSA-gg9w-7593-hxg9 and the OSV entry EEF-CVE-2026-82736 for advisory metadata.

Workarounds

Add a custom validate step to affected resources that manually case-folds the input before applying the match regex or length checks.
Constrain input at the API boundary using a stricter type or changeset validation that enforces case rules prior to persistence.
Restrict access to actions that write Ash.Type.CiString attributes until the upgrade is deployed.

bash

# Update ash to the patched release
mix deps.update ash
mix deps.get
mix compile
# Verify the installed version is >= 3.32.2
mix deps | grep ash