CVE-2026-82744: Ash Package Fails Open on Change Step Guard Exception
Summary
CVE-2026-82744: Ash.Reactor change step fails open, skipping a change when its where guard raises. Affects ash across 2 version ranges.
>= 3.0.0-rc.17, < 3.32.2
>= 321f43bd05ad9544e693cbf797243693e51a6be4, < 6d2eb86ea8d2ba5ffac89c1b8b9bf46e331feabc
Fixed in 3.32.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Ash framework is an open-source project designed for building APIs and applications in Elixir. It provides a set of tools and abstractions that simplify the development process, allowing developers to focus on business logic rather than boilerplate code. The framework includes features such as data validation, authorization, and reactive programming capabilities. However, a vulnerability has been identified in the Ash.Reactor component, which can lead to security issues when change steps are improperly handled.
Vulnerability Detail
The vulnerability arises from the Ash.Reactor change step's handling of guards that control whether a change should be executed. When a guard raises an exception, instead of failing securely and halting the change, the system treats it as if the guard condition was simply not met, allowing the change to be skipped. This failing open behavior can lead to security-relevant modifications being bypassed, potentially exposing the application to unauthorized changes or data manipulation. The issue affects versions of the Ash package from 3.0.0-rc.17 up to, but not including, 3.32.2.
How To Fix
Latest published version: 3.37.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.32.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can implement additional error handling around the change steps to ensure that any raised exceptions are logged and handled appropriately, preventing unintended skips of critical changes.
Conclusion
In summary, CVE-2026-82744 presents a significant risk to applications using the Ash framework due to its failing open behavior when handling change step guards. It is crucial for developers to update to the latest version to mitigate this vulnerability and ensure the security of their applications.
See every vulnerability recorded for ash →
FAQ
CVE-2026-82744 is a vulnerability in the Ash framework that allows change steps to be skipped if a guard raises an exception, leading to potential security risks.
The vulnerability affects Ash versions from 3.0.0-rc.17 up to, but not including, 3.32.2.
You can use Vulert, a tool that monitors and alerts for open-source vulnerabilities in real-time, to check if your application is affected. Visit Vulert Scanner to use the Vulert playground without signup.
If an immediate update is not possible, implement additional error handling around the change steps to manage exceptions and prevent unintended skips.
The CVSS score for this vulnerability is 2.1, indicating a low severity level.
Related vulnerabilities
Recent vulnerabilities recorded for ash.
