EEF-CVE-2026-82726 CVE-2026-82726 GHSA-rpf8-q9jh-qxrr
AshPhoenix get_subdomain maps a crafted or differently-cased Host header to an arbitrary tenant
- Severity
- 0.0 / 10
- Unknown · CVSS 4.0
- Exploit chance (EPSS)
- 0.52%
- Chance of exploitation in the next 30 days. Higher than 44.45% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Fix
2.3.25- Upgrade ash_phoenix to this version or later
Description
Summary
Permissive Regular Expression vulnerability in ash-project ash_phoenix lets a remote client select the tenant an Ash application uses, or degrade the request, by sending a crafted Host header.
AshPhoenix.Helpers.get_subdomain/2 stripped the root domain with String.replace(host, ~r/.?#{root_host}/, ""). The root host was interpolated raw, so each . became a wildcard and any metacharacter a pattern, and the replace was global and unanchored, so a match was removed from anywhere in the string. With root_host example.com, Host: foo.exampleXcom.attacker.net returned the tenant foo.attacker.net. A metacharacter-bearing or nil root host degraded the pattern or raised on every request. The comparison was also case-sensitive, so TENANT.EXAMPLE.COM and EXAMPLE.COM slipped past the root-host allowlist. conn.host comes from the client Host header. The fix matches the root host case-insensitively and only as an exact trailing suffix.
This issue affects ash_phoenix: from 2.1.26 before 2.3.25.
Configurations
The application uses subdomain-based multitenancy via AshPhoenix.Helpers.get_subdomain/2 (for example through AshPhoenix.LiveView.SubdomainHook) to select the tenant from the request host.
Affected versions
Hex
| Package | Vulnerable | Fixed in |
|---|---|---|
| ash_phoenix | >= 2.1.26, < 2.3.25 |
2.3.25 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
ash_phoenix Hex → 2.3.25
- mix
{:ash_phoenix, "~> 2.3.25"} # then: mix deps.update ash_phoenix
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- Present
- Privileges required
- None
- User interaction
- None
- Confidentiality (vulnerable system)
- Low
- Integrity (vulnerable system)
- Low
- Availability (vulnerable system)
- Low
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
Weakness
CWE-625: Permissive Regular Expression
The product uses a regular expression that does not sufficiently restrict the set of allowed values.
How to prevent it
- Implementation: When applicable, ensure that the regular expression marks beginning and ending string patterns, such as "/^string$/" for Perl.
CWE-178: Improper Handling of Case Sensitivity
The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.
How to prevent it
- Architecture and Design: Avoid making decisions based on names of resources (e.g. files) if those resources can have alternate names.
- Implementation: Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
- Implementation: Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.
References
Advisories
Fixes and patches
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| EEF-CVE-2026-82725 AshPhoenix FilterForm allows filtering across non-public relationships, disclosing private related data | Not rated yet | Also affects ash_phoenix |
| EEF-CVE-2026-82724 Broken access control in AshPhoenix SubdomainHook via a nil tenant in handle_subdomain | Not rated yet | Also affects ash_phoenix |
| EEF-CVE-2026-82727 AshPhoenix Form.Auto leaks submitted params in an unknown _union_type error message | Not rated yet | Also affects ash_phoenix |
| GHSA-vr34-hp96-76pp xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator | High | Same weakness, CWE-625 |
| GHSA-jxjr-3g7g-3944 xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator | High | Same weakness, CWE-625 |
| GHSA-3px3-54cx-rmw9 xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path | High | Same weakness, CWE-625 |
| GHSA-6g6r-q6gw-w8fg PraisonAI has a Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92) | Critical | Same weakness, CWE-625 |
| GHSA-7g26-2qgj-chfg CarrierWave has a denylisted_content_type bypass via Unescaped Regex Metacharacters | Medium | Same weakness, CWE-625 |
Credits: Jonatan Männchen / EEF, Peter Ullrich, Zach Daniel / Ash Project
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor