Is CVE-2026-81853 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-81853 being exploited in the wild.

How severe is CVE-2026-81853?

Informational severity, published 31 August 2026.

Which products and versions are affected?

Ash-Project Ash Admin 0.1.0 before 1.3.1.

Is there a fix for CVE-2026-81853?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-81853 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-81853?

Check whether you run Ash-Project Ash Admin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-81853: ash-project ash_admin authorization bypass via user-controlled key

CVE-2026-81853 · Severity: info · Published 2026-08-31

ash_admin is an administrative interface for the Ash data framework. A vulnerability in its primary-key decoding allows attackers to bypass authorization checks by injecting arbitrary attributes (like API tokens) into record lookups, effectively turning the system into an oracle for guessing sensitive values one character at a time without proper validation.

Technologies: Ash-Project Ash Admin. Vendors: Ash-Project.

Quick answers

Is CVE-2026-81853 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-81853 being exploited in the wild.
How severe is CVE-2026-81853?: Informational severity, published 31 August 2026.
Which products and versions are affected?: Ash-Project Ash Admin 0.1.0 before 1.3.1.
Is there a fix for CVE-2026-81853?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-81853 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-81853?: Check whether you run Ash-Project Ash Admin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in AshAdmin.Helpers.decode_primary_key/2, which deserializes a Base64-encoded Erlang Term Format (ETF) composite key and uses it directly as a lookup filter without validating that decoded keys correspond to actual primary-key fields. Although deserialization guards restrict atom/function injection and nested expressions, they do not constrain which field names are allowed back through the :safe option, permitting any interned attribute name. An attacker can craft a payload encoding %{api_token: "guess"} to splice arbitrary sensitive attributes into the lookup filter, enabling brute-force enumeration of secrets (API tokens, reset tokens, etc.) via equality checks. The fix restricts decoded keys to only legitimate primary-key fields.

Affected products

ash-project ash_admin 0.1.0 before 1.3.1

Timeline

2026-08-31: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.