CVE-2026-82739: CWE-209 Generation of Error Message Containing Sensitive Information in ash-project ash
Description
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash discloses the stored value of a confirmed field to an actor who fails its confirmation check. Ash.Resource.Validation.Confirm's atomic implementation (atomic/2 in lib/ash/resource/validation/confirm.ex) built the mismatch error with its value set to the field being confirmed. When the actor supplies only the confirmation argument and not the field itself, value resolves through atomic_ref/2 to the field's current stored value, so the mismatch error echoes that stored value back to the actor. Against a confirmation guarding a sensitive attribute, an actor can submit a deliberately wrong confirmation and read the real value from the returned error. The fix reports the actor-supplied confirmation in the error instead of the stored field value. This issue affects ash: from 2.17.20 before 3.32.2.
CVSS v4.0
Score 2.1low
Affected software
ash-project
ash
ash-project
ash
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability arises in Ash.Resource.Validation.Confirm's atomic implementation, where a mismatch error message includes the stored value of a field being confirmed. If an actor submits only the confirmation argument without the original field, the error message leaks the stored sensitive value by echoing it back. This can expose sensitive information guarded by confirmation checks. The issue affects ash versions from 2.17.20 before 3.32.2. The fix involves changing the error message to report the actor-supplied confirmation instead of the stored field value.
Potential Impact
An attacker who fails a confirmation check can obtain the actual stored value of a sensitive field through the error message. This information disclosure could lead to leakage of sensitive data. The CVSS score is low (2.1), indicating limited impact and exploitability. There are no known exploits in the wild.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The fix described involves modifying the error message to avoid disclosing the stored value and instead show the actor-supplied confirmation. Until an official fix is available, avoid exposing sensitive fields to confirmation checks that generate error messages containing their values.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- EEF
- Date Reserved
- 2026-08-31T00:59:10.002Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a964c16acd9273b492d1357
Added to database: 09/01/2026, 03:52:54 UTC
Last enriched: 09/07/2026, 15:05:38 UTC
Last updated: 10/15/2026, 06:48:19 UTC
Views: 89
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.