Vulnerability · Published Sep 1, 2026 · Assigned by EEF
CVE-2026-82744Ash.Reactor change step fails open, skipping a change when its where guard raises
Low 2.1
In plain English
A low-severity security flaw in ash from ash-project. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).
Official description
Not Failing Securely (Failing Open) vulnerability in ash-project ash skips an Ash.Reactor change when the guard controlling it raises, so a change meant to run does not. An Ash.Reactor change step can be gated by where validations that decide whether the change runs. Ash.Reactor.ChangeStep (lib/ash/reactor/steps/change_step.ex) evaluated those guards in apply_where_clauses/3, and apply_validation rescued any exception into {:error, error}. The reduce treated that identically to a guard whose condition was simply not met and bypassed the change. So when a guard raises (for example on attacker-influenced input), a change that enforces a security-relevant modification is skipped rather than failing the step. The fix distinguishes a raised exception (now {:raised, error}) and halts the step with an error, failing closed. This issue affects ash: from 3.0.0-rc.17 before 3.32.2.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ash-project | ash | 3.0.0-rc.17 – before 3.32.2 |
| ash-project | ash | 321f43bd05ad9544e693cbf797243693e51a6be4 – before 6d2eb86ea8d2ba5ffac89c1b8b9bf46e331feabc |
Weakness: CWE-636 · Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N