CVE-2026-55736: Ash Package Vulnerability Allows User Input to Override Private Action Arguments
Summary
CVE-2026-55736: Ash: Private action arguments can be set by user input via string-keyed params and atomic changesets. Affects ash versions >= 3.0.0, < 3.29.3. Fixed in 3.29.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Ash package is a powerful framework designed for building APIs and managing data in Elixir applications. It provides a robust set of features for defining resources, actions, and changesets, allowing developers to create complex applications with ease. However, a vulnerability exists that allows untrusted user input to manipulate private action arguments, which are intended to be controlled solely by server-side code.
Vulnerability Detail
The vulnerability arises from Ash's failure to consistently strip private action arguments (declared with public?: false) when building changesets from untrusted parameter maps. This inconsistency allows attackers to inject values for private arguments, which should only be set by trusted server-side code. The issue is particularly concerning when private arguments are used for authorization or identity management, as it can lead to integrity violations or privilege escalation. The vulnerability is present in both regular and atomic parameter handling paths, making it accessible through various means.
How To Fix
Latest published version: 3.37.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.29.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can manually validate and sanitize input parameters before passing them to actions that define private arguments. This can be done by checking for the presence of private argument keys in the parameter map and removing them if found. Example code snippet:
params = Map.drop(params, [:acting_user_id])
Conclusion
The vulnerability identified as CVE-2026-55736 in the Ash package poses a significant risk by allowing user input to manipulate private action arguments. It is crucial for developers to update to the patched version 3.29.3 to mitigate this risk and ensure the integrity of their applications.
See every vulnerability recorded for ash →
FAQ
The vulnerability allows untrusted user input to set private action arguments, which should only be controlled by server-side code.
If exploited, an attacker could manipulate private arguments, potentially leading to unauthorized access or privilege escalation.
Versions of the Ash package prior to 3.29.3 are affected by this vulnerability.
Update your mix.exs file to specify version 3.29.3 or later and run 'mix deps.update ash' to apply the fix.
Yes, you can use Vulert to monitor and alert for open-source vulnerabilities in your software without requiring access to the code. Visit Vulert Scanner to check your application.
References
Related vulnerabilities
Recent vulnerabilities recorded for ash.
