CVE-2026-55736: CVE-2026-55736: Mass Assignment / Parameter Pollution in Ash Framework Changeset Path

CVE-2026-55736: Mass Assignment / Parameter Pollution in Ash Framework Changeset Path

Vulnerability ID: CVE-2026-55736
CVSS Score: 5.9
Published: 2026-09-24

A parameter injection vulnerability exists in the Ash framework for Elixir, where untrusted string-keyed maps can bypass the 'public?: false' restriction on action arguments. An attacker can leverage this bypass to inject and overwrite private arguments, resulting in unauthorized data modification or privilege escalation depending on the target application's design.

TL;DR

The Elixir Ash framework failed to check the 'public?' flag on action arguments when processing parameters with string keys or executing atomic updates, allowing unauthorized users to modify private parameters.

---

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-915
• Attack Vector: Local
• CVSS v4.0: 5.9 (Medium)
• EPSS Score: 0.00367
• Impact: High Integrity Violation
• Exploit Status: poc
• KEV Status: Not Listed

Affected Systems

• Applications utilizing the Ash Framework (Elixir) with active resources defining private action arguments (public?: false).
• ash: >= 3.0.0, < 3.29.3 (Fixed in: 3.29.3)

Code Analysis

Commit: d9b3100

Fix: verify that arguments are public when casting input

Commit: 1ae2cad

Related Versioning and dependency alignment

Exploit Details

• GitHub Security Advisory Integration Testing: The advisory contains reproduction unit tests showing the failure of string-keyed parameters to block private argument allocation.

Mitigation Strategies

• Upgrade the Ash framework library dependency to version 3.29.3 or higher.
• Sanitize untrusted parameter maps at the application boundary (e.g., Phoenix Controllers/Plugs) to remove keys representing private arguments.

Remediation Steps:

1. Open your Elixir application's 'mix.exs' file.
2. Update the ':ash' dependency requirement to version '~> 3.29.3'.
3. Execute 'mix deps.update ash' in your terminal.
4. Run tests to ensure that existing private arguments function as intended when set programmatically via 'Ash.Changeset.set_private_argument/3'.

References

• GHSA-f4hc-ppw9-4hhw: Ash Framework Security Advisory
• NVD - CVE-2026-55736
• Erlang Ecosystem Foundation CNA Record
• OSV Entry: EEF-CVE-2026-55736

---

Read the full report for CVE-2026-55736 on our website for more details including interactive diagrams and full exploit analysis.