Permissive Regular Expression Vulnerability in Ash Phoenix by Ash Project

CVE-2026-82726

What is CVE-2026-82726?

The vulnerability in Ash Phoenix allows a remote attacker to exploit a permissive regular expression matching mechanism. By crafting a malicious Host header, an attacker can influence the tenant selection process of an Ash application, leading to unauthorized access or manipulation of the application’s behavior. This issue arises due to improper handling of the root domain in regular expressions, enabling wildcard-like behavior and bypassing security checks. The vulnerability affects versions of ash_phoenix prior to 2.3.25, making it essential for users to update to mitigate potential risks.

References