CVE-2026-82741: Ash Framework Auth Bypass Vulnerability

CVE-2026-82741 Overview

CVE-2026-82741 is a type confusion vulnerability in the ash-project/ash Elixir framework. The flaw affects Ash.Type.Union values that use storage: :map_with_tag. The framework's Ash.Type.Union.dump_to_native/2 function in lib/ash/type/union.ex did not force the configured tag when writing values. Attackers can submit a value with a tag naming one union member while the payload data belongs to another member. On read, the value is re-selected by its attacker-controlled tag and treated as an incompatible member, bypassing that member's validation and any tag-based authorization logic [CWE-1287].

Critical Impact
An attacker with local input access can persist union values with mismatched tags to bypass validation and policy checks that branch on the union tag.

Affected Products

ash-project/ash from version 2.14.18
ash-project/ash versions before 3.32.2
Elixir applications using Ash.Type.Union with storage: :map_with_tag

Discovery Timeline

2026-09-01 - CVE-2026-82741 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-82741

Vulnerability Analysis

The Ash framework provides a Ash.Type.Union type that stores tagged variants of related data. When configured with storage: :map_with_tag, each union member is identified by a configured tag field and a tag_value. The framework relies on this tag to select the correct member schema for validation, casting, and authorization.

The dump_to_native/2 function accepted the tag value present in the incoming map instead of forcing the configured tag_value. An attacker who supplies a value shaped like member A but stamped with member B's tag causes the storage layer to persist inconsistent state. Subsequent reads dispatch on the persisted tag, treating member A's data as member B. This bypasses member B's constraints entirely and misroutes any policy code that branches on the union tag.

Root Cause

The root cause is improper validation of a specified type of input [CWE-1287]. The dump path trusted a caller-supplied discriminator instead of overwriting it with the schema-configured value. This violates the invariant that a stored member's tag must match the schema of the data it labels.

Attack Vector

Exploitation requires the attacker to submit a crafted union value through an Ash action that persists the record. No authentication is inherently required at the framework layer, though application-level access controls may apply. The attacker sets the tag field to name a different union member than the data represents. The record round-trips through storage and is later interpreted under the wrong member's rules.

text

# Patch diff for lib/ash/type/union.ex
# Source: https://github.com/ash-project/ash/commit/8dbdaecd0f115f52e7c3f9a3e798617d6fbf5f7d

               {:ok, nil}
 
             {:ok, value} ->
-              if Map.has_key?(value, config[:tag]) ||
-                   (is_atom(config[:tag]) && Map.has_key?(value, to_string(config[:tag]))) do
-                {:ok, value}
-              else
-                {:ok, Map.put(value, config[:tag], config[:tag_value])}
-              end
+              value =
+                value
+                |> Map.drop([config[:tag], to_string(config[:tag])])
+                |> Map.put(config[:tag], config[:tag_value])
+
+              {:ok, value}
           end
       end
     else

The fix drops any caller-supplied tag key from the value map and unconditionally sets the configured tag_value before writing.

Detection Methods for CVE-2026-82741

Indicators of Compromise

Persisted records where a union field's tag value does not match the schema member whose constraints the payload satisfies.
Application errors or policy anomalies triggered when reading records that use Ash.Type.Union with storage: :map_with_tag.
Audit log entries showing writes to union-typed columns from clients supplying explicit tag fields.

Detection Strategies

Inventory Ash resources for attributes typed as Ash.Type.Union with storage: :map_with_tag and confirm the deployed ash dependency version.
Run integrity queries against stored union columns to identify rows where the persisted tag is inconsistent with the payload shape expected by that member.
Review Ash action logs for user-controlled inputs that populate the tag field directly.

Monitoring Recommendations

Monitor dependency manifests (mix.exs, mix.lock) for ash versions between 2.14.18 and 3.32.2 across build pipelines.
Track deserialization errors and constraint violations originating from union types after upgrade to detect legacy malformed records.
Alert on authorization decisions that branch on union tags and reference records written before the patch.

How to Mitigate CVE-2026-82741

Immediate Actions Required

Upgrade ash to version 3.32.2 or later in all Elixir services using the framework.
Audit existing data in resources that use Ash.Type.Union with storage: :map_with_tag to identify and remediate records with mismatched tags.
Review any authorization policies that use union tags as branch conditions and validate their assumptions post-upgrade.

Patch Information

The vendor released the fix in commit 8dbdaecd0f115f52e7c3f9a3e798617d6fbf5f7d, included in ash version 3.32.2. Details are available in the GitHub Security Advisory GHSA-2mmm-gc86-7jgg and the CNA advisory.

Workarounds

Strip tag fields from user-supplied input before passing values to Ash actions that write union attributes.
Add custom change functions on affected actions to force the correct tag value prior to persistence.
Restrict access to actions that write map_with_tag union attributes until the upgrade is deployed.

bash

# Update ash dependency in mix.exs and refresh the lockfile
# {:ash, "~> 3.32.2"}
mix deps.update ash
mix deps.get
mix compile