Quick answers
- Is CVE-2026-82722 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-82722 being exploited in the wild.
- How severe is CVE-2026-82722?
- Informational severity, published 31 August 2026.
- Which products and versions are affected?
- Ash-Project Ash Admin from 0.1.0 before 1.3.1.
- Is there a fix for CVE-2026-82722?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-82722 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-82722?
- Check whether you run Ash-Project Ash Admin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is an Allocation of Resources Without Limits or Throttling vulnerability (CWE-770) in two LiveView event handlers. The AshAdmin.PageLive.set_actor handler converts client-supplied resource and domain names into atoms using Module.concat/1, and AshAdmin.Components.Resource.Show.calculate converts submitted form keys into atoms using String.to_atom/1. Since atoms are never garbage collected in the BEAM VM and the atom table has a fixed capacity, an attacker can mint a new atom per request with random strings until the VM runs out of atom slots and terminates. No authentication is required—the attack succeeds against any client with network access to the admin interface. The fix validates submitted resource/domain values against known resources and maps form keys to declared arguments, preventing arbitrary atom creation.
Affected products
- ash-project ash_admin from 0.1.0 before 1.3.1
Timeline
- 2026-08-31: disclosed