CVE-2026-82739: Ash Framework Information Disclosure Flaw

CVE-2026-82739 Overview

CVE-2026-82739 is an information disclosure vulnerability in the ash-project/ash Elixir framework. The flaw resides in Ash.Resource.Validation.Confirm's atomic implementation, where mismatch errors leak the stored value of the confirmed field back to the caller. An actor who submits only the confirmation argument and a deliberately wrong value can read the real stored value of a sensitive attribute from the returned error message. The vulnerability is tracked under [CWE-209: Generation of Error Message Containing Sensitive Information] and affects ash versions from 2.17.20 before 3.32.2.

Critical Impact
Any authenticated or unauthenticated actor able to invoke a confirmation-guarded action can extract the current stored value of a sensitive attribute by submitting a wrong confirmation.

Affected Products

ash-project/ash (Elixir Ash framework) versions >= 2.17.20
ash-project/ash versions < 3.32.2
Any application using Ash.Resource.Validation.Confirm on sensitive attributes

Discovery Timeline

2026-09-01 - CVE-2026-82739 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-82739

Vulnerability Analysis

The vulnerability lives in atomic/2 inside lib/ash/resource/validation/confirm.ex. When a caller supplies only the confirmation argument and omits the field itself, the code path builds the mismatch error using value, which resolves through atomic_ref/2 to the field's current stored value in the database. The resulting error message echoes that stored value back to the caller. Because Ash.Resource.Validation.Confirm is commonly applied to sensitive attributes such as passwords, email addresses, or tokens, the error response becomes a read primitive against otherwise protected data.

Root Cause

The root cause is a mismatch between the value used for the atomic equality check and the value included in the user-facing error. The comparison correctly evaluates confirmation != value, but the error payload also references value instead of the actor-supplied confirmation. The framework relied on the error consumer to treat the mismatch message as opaque, which is unsafe when value is the sensitive attribute being confirmed.

Attack Vector

An actor invokes an action that triggers the atomic confirm validation on a sensitive field. The actor supplies only the confirmation argument with an intentionally wrong value and omits the primary field. The atomic validation resolves value from the current stored record, detects the mismatch, and returns an error whose payload contains that stored value. The attack requires local access to the action endpoint but no privileges or user interaction beyond submitting the request.

text

            Ash.Resource.Validation.should_redact?(changeset, opts[:field]) do
         Ash.Helpers.redact(nil)
       else
-        value
+        confirmation
       end
 
     {:atomic, [opts[:confirmation], opts[:field]], Ash.Expr.expr(^confirmation != ^value),

Source: GitHub commit 7dfe5f0. The patch replaces value with confirmation in the mismatch error branch so the response echoes the actor-supplied input rather than the stored field.

Detection Methods for CVE-2026-82739

Indicators of Compromise

Repeated action invocations that supply the confirmation argument but omit the primary field.
High volumes of Ash.Error.Changes.InvalidChanges or mismatch validation errors targeting sensitive attributes such as password, email, or token.
Anomalous per-actor error rates against endpoints that back confirmation-validated resources.

Detection Strategies

Inspect application logs for confirm-mismatch errors whose payload contains data matching the format of protected attributes.
Audit Ash resource definitions to identify every attribute guarded by Ash.Resource.Validation.Confirm and correlate them with error telemetry.
Add structured logging around confirm validations to record which actor supplied which arguments before the fix is deployed.

Monitoring Recommendations

Alert on unusual ratios of confirmation-only submissions from a single actor or IP.
Monitor for scripted probing that iterates through actions on resources with sensitive attributes.
Track deployment coverage of ash3.32.2 or later across all services that consume the framework.

How to Mitigate CVE-2026-82739

Immediate Actions Required

Upgrade ash to version 3.32.2 or later across all Elixir services in your inventory.
Review every resource that uses Ash.Resource.Validation.Confirm and confirm the guarded attributes.
Rotate any secrets or sensitive values that may have been exposed through mismatch errors in logs or client responses.

Patch Information

The fix is provided in ash version 3.32.2, delivered by commit 7dfe5f0. Additional details are available in GitHub Security Advisory GHSA-66cg-vj5m-8w7v, the CNA advisory from the Erlang Ecosystem Foundation, and the OSV record EEF-CVE-2026-82739.

Workarounds

Mark sensitive attributes with the framework's redaction mechanism so Ash.Resource.Validation.should_redact?/2 returns true and the mismatch error is redacted.
Suppress or sanitize confirm validation error payloads at the API boundary until the patched version is deployed.
Require both the field and its confirmation to be present, rejecting requests that supply only the confirmation argument.

bash

# Update the ash dependency in mix.exs, then fetch and compile
# mix.exs
# {:ash, "~> 3.32.2"}

mix deps.update ash
mix deps.get
mix compile