CVE-2026-82741: Ash Package Type Confusion Vulnerability Due to Improper Tag Handling
Summary
CVE-2026-82741: Ash.Type.Union with :map_with_tag does not force the tag on dump, enabling tag confusion. Affects ash across 2 version ranges.
>= 2.14.18, < 3.32.2
>= b0bd2d23d979e731610327636f51da4981fcef68, < 8dbdaecd0f115f52e7c3f9a3e798617d6fbf5f7d
Fixed in 3.32.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Ash package is an open-source framework designed for building APIs in Elixir. It provides a powerful way to define resources, relationships, and actions, enabling developers to create complex applications with ease. However, a recent vulnerability has been identified that affects the way Ash handles type tags in union types, specifically those using storage with map_with_tag. This vulnerability can lead to unauthorized access and data manipulation.
Vulnerability Detail
The vulnerability arises from improper validation of the specified type of input in Ash.Type.Union when using storage: :map_with_tag. The function Ash.Type.Union.dump_to_native/2 fails to enforce the configured tag during the dumping process, allowing an attacker to submit a value with a tag that does not correspond to its actual data type. This results in a type confusion where the data is treated as belonging to a different member of the union, bypassing validation and authorization checks. The potential ramifications include unauthorized data access and manipulation, as the constraints and policies associated with the actual member are ignored.
How To Fix
Latest published version: 3.37.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.32.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can manually validate the tags before storing values in the union types to ensure that the correct tags are being used. This can be done by implementing custom validation logic in the application code to check the incoming tags against the expected tags for each member of the union.
Conclusion
CVE-2026-82741 is a significant vulnerability in the Ash package that can lead to type confusion and unauthorized data access. It is crucial for developers using Ash to update to the patched version to mitigate this risk. Implementing temporary workarounds can help protect applications until the update is applied.
See every vulnerability recorded for ash →
FAQ
CVE-2026-82741 is a vulnerability in the Ash package that allows for type confusion due to improper handling of tags in union types.
This vulnerability can lead to unauthorized access and manipulation of data, as it bypasses validation and authorization checks based on type tags.
The vulnerability affects Ash versions from 2.14.18 up to, but not including, 3.32.2.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, implement custom validation logic to ensure that the correct tags are used before storing values in union types.
Related vulnerabilities
Recent vulnerabilities recorded for ash.
