CVE-2026-82744 Ash.Reactor change step fails open, skipping a change when its where guard raises
Attackers can bypass security-relevant changes in Ash.Reactor by triggering exceptions in validation guards, causing the system to fail open and skip critical steps.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-82744?
CVE-2026-82744 is a low-severity vulnerability in ash-project ash, published on 1 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Not Failing Securely (Failing Open) vulnerability in ash-project ash skips an Ash.Reactor change when the guard controlling it raises, so a change meant to run does not.
An Ash.Reactor change step can be gated by where validations that decide whether the change runs. Ash.Reactor.ChangeStep (lib/ash/reactor/steps/change_step.ex) evaluated those guards in apply_where_clauses/3, and apply_validation rescued any exception into {:error, error}. The reduce treated that identically to a guard whose condition was simply not met and bypassed the change. So when a guard raises (for example on attacker-influenced input), a change that enforces a security-relevant modification is skipped rather than failing the step. The fix distinguishes a raised exception (now {:raised, error}) and halts the step with an error, failing closed.
This issue affects ash: from 3.0.0-rc.17 before 3.32.2.
Weakness: CWE-636
Which versions are affected by CVE-2026-82744?
1 open source package ship an affected version, including ash.
| Package | Affected | Fixed in |
|---|---|---|
ash Hex | From 3.0.0-rc.17 | 3.32.2 |
How do I fix CVE-2026-82744?
Upgrade ash to 3.32.2 or later.
Is CVE-2026-82744 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-82744 exists.
Sources
Also known as EEF-CVE-2026-82744, GHSA-3xq4-m876-fr88.