CVE-2026-82741

Improper Validation of Specified Type of Input vulnerability in ash-project ash lets an attacker confuse the stored type tag of an Ash.Type.Union value that uses storage: :map_with_tag, bypassing that member's validation and any tag-based authorization. For a union with storage: :map_with_tag, each member is identified in storage by a configured tag and tag_value. Ash.Type.Union.dump_to_native/2 (lib/ash/type/union.ex) did not force the configured tag when writing the value, so a tag carried in the submitted value was persisted verbatim. An attacker can therefore store a value whose data belongs to one member but whose tag names a different member. On read the value is re-selected by its tag and treated as the incompatible member (a type confusion), bypassing the real member's constraints and any logic or policy that branches on the union tag. The fix drops any incoming tag and forces the configured tag value on dump. This issue affects ash: from 2.14.18 before 3.32.2.

• CWE-1287

• https://cna.erlef.org/cves/CVE-2026-82741.html
• https://github.com/ash-project/ash/commit/8dbdaecd0f115f52e7c3f9a3e798617d6fbf5f7d
• https://github.com/ash-project/ash/security/advisories/GHSA-2mmm-gc86-7jgg
• https://osv.dev/vulnerability/EEF-CVE-2026-82741
• https://github.com/ash-project/ash/security/advisories/GHSA-2mmm-gc86-7jgg

Published

Sep 1, 2026

Last Modified

Sep 1, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-82736Incorrect Behavior Order: Validate Before Canonicalize vulne…2.1
• CVE-2026-82737Integer Overflow or Wraparound vulnerability in ash-project …5.9
• CVE-2026-82738Improper Input Validation vulnerability in ash-project ash a…5.9
• CVE-2026-82739Generation of Error Message Containing Sensitive Information…2.1
• CVE-2026-8274A security vulnerability has been detected in npitre cramfs-…5.3
• CVE-2026-82740Improper Input Validation vulnerability in ash-project ash f…2.1
• CVE-2026-82742Uncontrolled Resource Consumption vulnerability in ash-proje…5.9
• CVE-2026-82743Uncontrolled Resource Consumption vulnerability in ash-proje…2.1
• CVE-2026-82744Not Failing Securely (Failing Open) vulnerability in ash-pro…2.1
• CVE-2026-82745Improper Access Control vulnerability in ash-project ash let…5.9
• CVE-2026-82746Missing Authorization vulnerability in ash-project ash allow…5.9
• CVE-2026-82747Incorrect Authorization vulnerability in ash-project ash ret…5.9