CVE-2026-82739
Description
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash discloses the stored value of a confirmed field to an actor who fails its confirmation check. Ash.Resource.Validation.Confirm's atomic implementation (atomic/2 in lib/ash/resource/validation/confirm.ex) built the mismatch error with its value set to the field being confirmed. When the actor supplies only the confirmation argument and not the field itself, value resolves through atomic_ref/2 to the field's current stored value, so the mismatch error echoes that stored value back to the actor. Against a confirmation guarding a sensitive attribute, an actor can submit a deliberately wrong confirmation and read the real value from the returned error. The fix reports the actor-supplied confirmation in the error instead of the stored field value. This issue affects ash: from 2.17.20 before 3.32.2.
How to fix
- ash-project ash3.32.2, 7dfe5f0b1ba4267580ded947dc861351d4dc8e2b or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ash-project ash | 2.17.20 ≤ v < 3.32.2, fadecf3ee95640bd3bc7298df4799e0375537fd2 ≤ v < 7dfe5f0b1ba4267580ded947dc861351d4dc8e2b | 3.32.2, 7dfe5f0b1ba4267580ded947dc861351d4dc8e2b |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.