CVE-2026-82739 Ash.Resource.Validation.Confirm leaks a confirmed field's stored value in the atomic mismatch error
Attackers can read sensitive stored field values by triggering a confirmation mismatch error in the Ash framework.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-82739?
CVE-2026-82739 is a low-severity vulnerability in ash-project ash, published on 1 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash discloses the stored value of a confirmed field to an actor who fails its confirmation check.
Ash.Resource.Validation.Confirm's atomic implementation (atomic/2 in lib/ash/resource/validation/confirm.ex) built the mismatch error with its value set to the field being confirmed. When the actor supplies only the confirmation argument and not the field itself, value resolves through atomic_ref/2 to the field's current stored value, so the mismatch error echoes that stored value back to the actor. Against a confirmation guarding a sensitive attribute, an actor can submit a deliberately wrong confirmation and read the real value from the returned error. The fix reports the actor-supplied confirmation in the error instead of the stored field value.
This issue affects ash: from 2.17.20 before 3.32.2.
Weakness: CWE-209
Which versions are affected by CVE-2026-82739?
1 open source package ship an affected version, including ash.
| Package | Affected | Fixed in |
|---|---|---|
ash Hex | From 2.17.20 | 3.32.2 |
How do I fix CVE-2026-82739?
Upgrade ash to 3.32.2 or later.
Is CVE-2026-82739 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-82739 exists.
Sources
Also known as EEF-CVE-2026-82739, GHSA-66cg-vj5m-8w7v.