CVE-2026-81852
Received Received - Intake

Hardcoded CSP Nonce in AshAdmin

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: EEF

Description
Use of Insufficiently Random Values vulnerability in ash-project ash_admin ships a hardcoded, publicly known CSP nonce, defeating nonce-based Content-Security-Policy protection. When mounted without :csp_nonce_assign_key, AshAdmin.Router.ash_admin/2 defaulted the img, style, and script nonces to the literal constant ash_admin-Ed55GFnX, which AshAdmin.Layouts wrote verbatim into the nonce attribute of its inline <style> and <script> tags on every response. The value is a compile-time constant published in the repository and is never rotated per request. If an application's CSP script-src allow-lists that documented default, any HTML-injection sink on an admin page can reuse the known nonce to run inline scripts the policy was meant to block. The fix generates a fresh random nonce per request. This issue affects ash_admin: from 0.10.8 before 1.3.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-81852
EUVD
EUVD-2026-68328

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ash-project ash_admin From 0.10.8 (inc) to 1.3.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-330 The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a hardcoded Content Security Policy (CSP) nonce value 'ash_admin-Ed55GFnX' used in the ash_admin library. Nonces are meant to be unique per request to prevent script injection, but this static nonce is reused across all responses, making it predictable and publicly known. Attackers can exploit this by injecting malicious scripts with the known nonce, bypassing CSP protections intended to block inline scripts.

Detection Guidance

Check if your AshAdmin version is between 0.10.8 and 1.3.0 by inspecting dependency files like mix.exs. Look for hardcoded CSP nonce values in responses, specifically the static nonce ash_admin-Ed55GFnX in inline script or style tags.

Impact Analysis

If your application uses ash_admin versions 0.10.8 to 1.3.0 without overriding the default nonce, an attacker could exploit an HTML-injection vulnerability on an admin page. They could reuse the known nonce to execute malicious inline scripts that CSP was meant to block. This bypasses security controls but requires an existing HTML-injection flaw to trigger.

Compliance Impact

This vulnerability could undermine compliance efforts by weakening CSP protections, which are often required to safeguard user data and prevent XSS attacks. If CSP is bypassed, it may expose sensitive data, violating GDPR's data protection principles or HIPAA's security requirements for protected health information.

Mitigation Strategies

Upgrade AshAdmin to version 1.3.1 or later. If using versions before 1.3.1, ensure the :csp_nonce_assign_key option is set to generate fresh nonces per request. Review CSP policies to remove the hardcoded nonce from allow-lists.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81852. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart