CVE-2026-82741
Received Received - Intake

Type Confusion in Ash Framework via Union Tag Bypass

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: EEF

Description
Improper Validation of Specified Type of Input vulnerability in ash-project ash lets an attacker confuse the stored type tag of an Ash.Type.Union value that uses storage: :map_with_tag, bypassing that member's validation and any tag-based authorization. For a union with storage: :map_with_tag, each member is identified in storage by a configured tag and tag_value. Ash.Type.Union.dump_to_native/2 (lib/ash/type/union.ex) did not force the configured tag when writing the value, so a tag carried in the submitted value was persisted verbatim. An attacker can therefore store a value whose data belongs to one member but whose tag names a different member. On read the value is re-selected by its tag and treated as the incompatible member (a type confusion), bypassing the real member's constraints and any logic or policy that branches on the union tag. The fix drops any incoming tag and forces the configured tag value on dump. This issue affects ash: from 2.14.18 before 3.32.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-01
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-82741
EUVD
EUVD-2026-68946

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ash-project ash From 2.14.18 (inc) to 3.32.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1287 The product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Ash framework allows an attacker to manipulate the stored type tag of a union value with storage: :map_with_tag. The system fails to enforce the correct tag during data processing, causing type confusion where data from one union member is treated as another. This bypasses validation and authorization checks tied to the union's tag-based logic.

Detection Guidance

This vulnerability affects the Ash framework's union types with storage: :map_with_tag. To detect it, inspect your Ash application code for union types using this storage option. Check if any union attributes rely on tag-based validation or authorization. Review data storage for inconsistencies between stored tags and actual data types.

Impact Analysis

An attacker could submit data validated as a less privileged user but have it reload as a more privileged user, bypassing security controls. This could allow unauthorized access to sensitive functions or data, depending on how the application uses union types for authorization.

Mitigation Strategies

Upgrade the Ash framework to version 3.32.2 or later. If upgrading is not immediately possible, review all union types with storage: :map_with_tag and ensure proper tag enforcement in your application logic. Remove any reliance on tag-based authorization or validation for security decisions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82741. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart