CVE-2026-82741

Name of the Vulnerable Software and Affected Versions ash versions 2.14.18 through 3.32.1

Description An improper validation of input in ash-project ash allows an attacker to cause type confusion by manipulating the stored type tag of an Ash.Type.Union value using storage: :map with tag. This occurs because the dump to native/2 function in lib/ash/type/union.ex fails to force the configured tag when writing values, allowing a tag provided in the submitted value to be persisted verbatim. Consequently, an attacker can store data belonging to one member while assigning it a tag of a different member. Upon reading, the system treats the value as the incompatible member, bypassing validation constraints and tag-based authorization policies.

Recommendations Update ash to version 3.32.2 or later.