CVE-2026-82722: AshAdmin LiveView events intern atoms from client input, exhausting the atom table (node DoS)
Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashadmin lets any client that can reach the admin LiveView exhaust the BEAM atom table and crash the entire node.
Two LiveView event handlers interned atoms from unvalidated client input: AshAdmin.PageLive's setactor built modules from the resource/domain payload with Module.concat/1, and AshAdmin.Components.Resource.Show's calculate converted every submitted form key with String.toatom/1. Atoms are never garbage collected and the table is capped, so flooding either event with random names mints a new atom per request until the VM aborts, taking down every application on the node. The fix resolves the submitted resource/domain against the known shown resources and maps calculation keys to declared arguments, so no client-supplied string is interned.
This issue affects ashadmin: from 0.1.0 before 1.3.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ash-project/ash_adminto a version that resolves this vulnerability.Fixed in 1.3.1 - Configuration
Update AshAdmin.PageLive set_actor so submitted resource/domain values are resolved against the known shown resources; avoid using unvalidated client-supplied strings for module construction (Module.concat/1).
AshAdmin.PageLive set_actor actor module construction (Module.concat/1) behavior = Do not build module names from unvalidated client resource/domain payload; resolve submitted resource/domain against known shown resources and map calculation keys to declared arguments - Configuration
Update AshAdmin.Components.Resource.Show calculate so submitted form keys are mapped to declared arguments instead of converting every client-supplied key with String.to_atom/1.
AshAdmin.Components.Resource.Show calculate form key conversion (String.to_atom/1) behavior = Do not call String.to_atom/1 on client-supplied keys; use mapping to declared arguments
Event History
Frequently Asked Questions
Which deployments are exposed?
Any ash_admin deployment from version 0.1.0 before 1.3.1 is affected if a client can reach the admin LiveView. Successful exploitation can crash the entire BEAM node, affecting every application running on that node.
What does an attacker need to exploit this issue?
The attacker only needs the ability to send events to the admin LiveView. They can repeatedly submit random resource/domain values or calculation form keys to cause creation of new atoms until the atom table is exhausted.
Is there a configuration workaround if upgrading is not immediately possible?
The provided data does not identify a configuration-only mitigation. Limiting untrusted clients' ability to reach the admin LiveView can reduce exposure until upgrading to 1.3.1 or later.
How can I determine whether my instance has been affected?
Check whether the deployed ash_admin version is from 0.1.0 through versions before 1.3.1, and whether clients can access the admin LiveView. An affected node may abort after atom-table exhaustion, causing all applications on that node to go down.