CVE-2026-82722

ash_admin, the admin dashboard LiveView for the Elixir Ash framework, allocates resources without limits: two of its LiveView event handlers create BEAM atoms directly from unvalidated client input — AshAdmin.PageLive's set_actor builds module names from the submitted resource/domain via Module.concat/1, and AshAdmin.Components.Resource.Show's calculate interns every submitted form key via String.to_atom/1. Because atoms are never garbage-collected and the BEAM atom table is capped, any client with low-privileged access to the admin interface can flood either event with random names, minting a new atom per request until the Erlang VM aborts. The attacker gains denial of service: the crash takes down the entire node, killing every application running on it (high availability impact, no confidentiality or integrity impact). Anyone running ash_admin version 0.1.0 up to but not including 1.3.1 is affected, particularly where the admin LiveView is reachable over the network. No public proof-of-concept is known, the issue is not in CISA KEV, and EPSS puts 30-day exploitation probability at about 0.3%.

What to do: Upgrade ash_admin to 1.3.1 or later, where submitted resource/domain values are validated against known resources and calculation keys are mapped to declared arguments. Until then, restrict network access to admin LiveView routes (authentication, VPN/firewall allowlists) and monitor BEAM atom-table usage, restarting nodes if atom counts climb. Audit which deployed applications include ash_admin in their dependencies, since the crash affects the whole node, not just the admin UI.