CVE-2026-82726: CWE-625 Permissive Regular Expression in ash-project ash_phoenix

The vulnerability arises from AshPhoenix.Helpers.get_subdomain/2 using String.replace with a regular expression that interpolates the root host directly, turning dots into wildcards and allowing matches anywhere in the string. This permits crafted Host headers like 'foo.exampleXcom.attacker.net' to bypass tenant restrictions by incorrectly stripping the root host portion. Additionally, case-sensitive matching allowed bypasses such as 'TENANT.EXAMPLE.COM'. The issue affects ash_phoenix versions starting at 2.1.26 and before 2.3.25. The fix involves matching the root host case-insensitively and only as an exact trailing suffix.

An attacker can manipulate the Host header to select arbitrary tenants or degrade requests, potentially leading to tenant confusion or request handling issues. This could affect multi-tenant Ash applications relying on this subdomain parsing for tenant isolation. The CVSS 4.0 score is 6.3 (medium), reflecting network attack vector, low complexity, and partial impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix matches the root host case-insensitively and only as an exact trailing suffix. Until an official fix is released, applications should consider validating Host headers more strictly or applying custom filtering to prevent crafted Host header exploitation.