Is CVE-2026-81852 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-81852 being exploited in the wild.

How severe is CVE-2026-81852?

Informational severity, published 31 August 2026.

Which products and versions are affected?

Ash-Project Ash Admin 0.10.8 to 1.3.0.

Is there a fix for CVE-2026-81852?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-81852 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-81852?

Check whether you run Ash-Project Ash Admin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-81852: ash-project ash_admin hardcoded CSP nonce bypass

CVE-2026-81852 · Severity: info · Published 2026-08-31

AshAdmin, a web framework for building admin interfaces, shipped with a hardcoded, publicly known security token (nonce) used to protect against malicious script injection. This token was never changed on a per-request basis, allowing an attacker who can inject HTML on an admin page to bypass the Content Security Policy and execute arbitrary JavaScript with admin privileges.

Technologies: Ash-Project Ash Admin. Vendors: Ash-Project.

Quick answers

Is CVE-2026-81852 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-81852 being exploited in the wild.
How severe is CVE-2026-81852?: Informational severity, published 31 August 2026.
Which products and versions are affected?: Ash-Project Ash Admin 0.10.8 to 1.3.0.
Is there a fix for CVE-2026-81852?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-81852 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-81852?: Check whether you run Ash-Project Ash Admin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability stems from use of insufficiently random values in Content Security Policy (CSP) nonce generation. AshAdmin.Router.ash_admin/2 defaulted the img, style, and script nonces to a compile-time constant literal value "ash_admin-Ed55GFnX" when the :csp_nonce_assign_key option was not configured. This hardcoded nonce was written verbatim into the nonce attribute of inline <style> and <script> tags on every response. The nonce value is published in the repository and never rotates per request. An attacker exploiting an HTML-injection vulnerability on an admin page could reuse the known nonce to execute inline scripts that the CSP policy was intended to block. The vulnerability affects ash_admin versions 0.10.8 through 1.3.0; version 1.3.1 and later generate fresh random nonces per request.

Affected products

ash-project ash_admin 0.10.8 to 1.3.0

Timeline

2026-08-31: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.