CVE-2026-82722: CWE-770 Allocation of Resources Without Limits or Throttling in ash-project ash_admin

The vulnerability in ash_admin (CVE-2026-82722) involves allocation of resources without limits or throttling (CWE-770). Specifically, two LiveView event handlers intern atoms from unvalidated client input: AshAdmin.PageLive's set_actor uses Module.concat/1 on resource/domain payloads, and AshAdmin.Components.Resource.Show's calculate converts every submitted form key with String.to_atom/1. Because atoms are never garbage collected and the atom table is capped, an attacker can flood these handlers with random strings, causing new atoms to be created until the BEAM VM aborts, crashing the entire node and all applications running on it. The fix involves validating the submitted resource/domain against known resources and mapping calculation keys to declared arguments, preventing client-supplied strings from being interned as atoms. This vulnerability affects ash_admin versions >=0.1.0 and <1.3.1.

Successful exploitation allows an unauthenticated or low-privileged client to cause a denial of service by crashing the entire Erlang VM node hosting ash_admin. This is due to exhaustion of the BEAM atom table, which leads to VM abort. The impact is high as it affects availability of the node and all applications running on it.

No official patch or remediation level is explicitly stated in the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is applied, restrict access to the admin LiveView interface to trusted clients only to prevent exploitation. Avoid sending untrusted input that could trigger atom creation in the affected handlers.