13 CVEs in AshAdmin and AshAI Include Critical RCE

The Erlang Ecosystem Foundation’s CNA published 13 CVEs against two packages in the ash-project Elixir ecosystem today: AshAdmin, the web-based admin panel library, and AshAI, the framework’s AI integration layer. The vulnerabilities range from a hardcoded CSP nonce to a remote code execution flaw that requires no authentication at all.

The RCE is the lead here.

Unauthenticated Code Injection in AshAI (CVE-2026-77956)

CVE-2026-77956 is an improper code injection vulnerability in AshAI’s AshAi.Actions.Prompt implementation. The issue is that untrusted model output is evaluated as live Elixir code, and because the affected endpoint requires no authentication, any client that can reach it can run arbitrary Elixir on the server. In most Phoenix deployments that means arbitrary code execution on the host with the application’s OS privileges.

CVSS scoring from NVD is pending on this one; ERLEF CNA classified it as a code injection vulnerability without a score in the advisory at time of writing. The vulnerability class alone puts it in the critical tier regardless of what the final score lands on.

This is the same pattern that burned the MindsDB unauthenticated RCE disclosure earlier this month and the Ray AI framework KEV addition before that: AI frameworks evaluating model-supplied content as executable code. The problem is not novel. The lesson is not being learned fast enough.

AshAdmin: Path Traversal, DoS, XSS, and Authorization Bypass

The AshAdmin package drew nine CVEs in today’s batch, covering a broader surface than the RCE headline might suggest.

CVE-2026-82673 is a path traversal vulnerability allowing an attacker to write attacker-controlled bytes to arbitrary paths on the server via AshAdmin’s file-handling components. That is an unauthenticated write-to-anywhere primitive on any server exposing AshAdmin without additional access controls, which developers sometimes skip because AshAdmin feels like an internal tool.

CVE-2026-82722 allows any client that can reach the admin LiveView interface to exhaust the BEAM atom table. The BEAM VM’s atom table is a fixed-size global resource; once it fills, the entire Erlang/Elixir node crashes. The attack does not require authentication either, and there is no rate-limiting on the relevant interface.

CVE-2026-77850 is a stored XSS in AshAdmin’s relationship typeahead components: attacker-supplied record content executes as script in an administrator’s browser session. Stored XSS in an admin panel is a session-hijack waiting to happen.

CVE-2026-81853 turns a record-lookup URL into an equality oracle over sensitive attributes, enabling authorization bypass through user-controlled keys. CVE-2026-75757 allows session rebinding to a different actor from a sibling subdomain via missing cookie validation. CVE-2026-82681 enables link-target rewriting through an output encoding failure when a record uses a string primary key.

Completing the AshAdmin set: CVE-2026-81852 ships a hardcoded, publicly known CSP nonce, which defeats nonce-based Content-Security-Policy protection entirely.

AshAI: Four More Beyond the RCE

The RCE is the obvious lead, but the other AshAI CVEs are worth attention independently.

CVE-2026-82564 lets a caller of an identity-configured AI tool update or destroy records it never explicitly identified, including records it had no permission to access, by exploiting how the tool resolves authorization. CVE-2026-81315 allows a malicious web page to bypass the MCP server’s DNS-rebinding protection and issue cross-site requests to a user’s local MCP server, a variant of the attack class that hit ten MCP server CVEs in a single disclosure earlier this month.

CVE-2026-82579 (infinite loop in the AI tool loop, triggerable by an attacker who can influence model output) and CVE-2026-75760 plus CVE-2026-82580 (credentials and internal error state disclosed in user-facing validation errors) round out the AshAI findings.

What Developers Should Do

ERLEF CNA published advisories for all 13 CVEs at cna.erlef.org/cves/. The advisories include version ranges and patch guidance for each finding. Developers using AshAdmin or AshAI should check those advisories, identify which CVEs apply to the versions they are running, and update immediately, starting with CVE-2026-77956 and CVE-2026-82673 given the unauthenticated exposure both carry.

Applications exposing AshAdmin to the open internet without authentication middleware in front of it should treat that configuration as an incident already in progress until patched. The admin panel was probably not designed with that exposure model in mind.

The MCP server DNS rebinding issue (CVE-2026-81315) is separately relevant to anyone running ash_ai’s MCP server component locally, where the attack surface is the browser on the developer’s own machine.

Thirteen CVEs in a coordinated ERLEF disclosure is a serious audit result. The individual findings are not exotic; they are familiar vulnerability classes that appear repeatedly across web frameworks, AI toolkits, and admin panels. The message from the advisory batch is that ash-project had several at once, they are patched now, and the community is better positioned having had this looked at.