CVE-2026-81852— AshAdmin ships a hardcoded CSP nonce, allowing nonce-based CSP bypass
Quick assessment
Affected
ash-project ash_admin
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
ash-project ash_admin 中“使用随机性不足的值”漏洞 ash_admin 模块使用了一个硬编码的、公知内容安全策略（CSP）nonce（随机数），从而使得基于 nonce 的 CSP 保护机制失效。 当未指定 参数挂载路由时， 默认将 、 和 的 nonce 设为字面量常量 。随后， 会在每个响应中，将该固定值原样写入内联 和 标签的 属性中。该值是编译期常量，已在代码库中公开，且不会随请求动态更新。如果应用程序的 CSP 白名单中包含了这一已知的默认值，那么管理页面中任何 HTML 注入漏洞点
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-81852
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
AshAdmin ships a hardcoded CSP nonce, allowing nonce-based CSP bypass
Source: CVE Program / CVE List V5
Vulnerability Description
Use of Insufficiently Random Values vulnerability in ash-project ash_admin ships a hardcoded, publicly known CSP nonce, defeating nonce-based Content-Security-Policy protection.
When mounted without :csp_nonce_assign_key, AshAdmin.Router.ash_admin/2 defaulted the img, style, and script nonces to the literal constant ash_admin-Ed55GFnX, which AshAdmin.Layouts wrote verbatim into the nonce attribute of its inline <style> and <script> tags on every response. The value is a compile-time constant published in the repository and is never rotated per request. If an application's CSP script-src allow-lists that documented default, any HTML-injection sink on an admin page can reuse the known nonce to run inline scripts the policy was meant to block. The fix generates a fresh random nonce per request.
This issue affects ash_admin: from 0.10.8 before 1.3.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用不充分的随机数
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| ash-project | ash_admin | 0.10.8 ~ 1.3.1 |
cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*
|
|
| ash-project | ash_admin | 99b8daed7b2f79d82fcd9e89338d41b0e1564aa7 ~ bc7a1cdf873b16971a8efec35d085f8bb706314f |
cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2026-81852
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-81852
请登录查看更多情报信息。
Other References for CVE-2026-81852 (4)
-
https://github.com/ash-project/ash_admin/security/advisories/GHSA-whfj-rrrp-j597 vendor-advisory related
Same Patch Batch · ash-project · 2026-08-31 · 13 CVEs total
| CVE-2026-77956 | 10.0 CRITICAL | EEx template evaluation of prompt content in AshAi enables remote code execution |
| CVE-2026-77850 | 8.4 HIGH | Stored XSS in AshAdmin relationship typeahead via unescaped label_field content |
| CVE-2026-82673 | 8.3 HIGH | Path traversal in AshAdmin file uploads via unsanitized client filename |
| CVE-2026-82722 | 8.3 HIGH | AshAdmin LiveView events intern atoms from client input, exhausting the atom table (node D |
| CVE-2026-75757 | 8.3 HIGH | AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a |
| CVE-2026-81315 | 7.4 HIGH | MCP DNS-rebinding origin check in AshAi is bypassed by a spoofed X-Forwarded-Proto header |
| CVE-2026-75760 | 7.1 HIGH | AshAi vectorize change leaks raw embedding-provider errors, including credentials, in a us |
| CVE-2026-82564 | 7.1 HIGH | Identity tool filter in AshAi accepts operator maps, allowing update or destroy of unident |
| CVE-2026-82579 | 6.0 MEDIUM | AshAi tool loop never terminates when all tool calls are filtered out, enabling denial of |
| CVE-2026-82580 | 5.3 MEDIUM | AshAi echoes raw tool exception messages into the conversation, disclosing internal detail |
| CVE-2026-81853 | 2.3 LOW | AshAdmin composite primary key decoding accepts arbitrary fields, enabling a secret-attrib |
| CVE-2026-82681 | 2.0 LOW | Query-parameter injection in AshAdmin row-action links via unencoded string primary keys |
IV. Related Vulnerabilities
Same product: ash_admin
-
CVE-2026-82673
Path traversal in AshAdmin file uploads via unsanitized clie -
CVE-2026-81853
AshAdmin composite primary key decoding accepts arbitrary fi -
CVE-2026-82681
Query-parameter injection in AshAdmin row-action links via u -
CVE-2026-77850
Stored XSS in AshAdmin relationship typeahead via unescaped -
CVE-2026-82722
AshAdmin LiveView events intern atoms from client input, exh
Same vendor: ash-project
-
CVE-2026-82673
Path traversal in AshAdmin file uploads via unsanitized clie -
CVE-2026-81853
AshAdmin composite primary key decoding accepts arbitrary fi -
CVE-2026-82681
Query-parameter injection in AshAdmin row-action links via u -
CVE-2026-77850
Stored XSS in AshAdmin relationship typeahead via unescaped -
CVE-2026-82722
AshAdmin LiveView events intern atoms from client input, exh
Same weakness: CWE-330
-
CVE-2026-82555
TOTOLINK N600R Authentication cstecgi.cgi loginAuth random v -
CVE-2026-19485
Bucket Squatting in Vertex AI Search for Commerce -
CVE-2026-56706
Adminer before 5.4.3 CSRF Token Secret Recovery via XOR Mask -
CVE-2026-19896
mangroup dtale Flask Session Cookie app.py build_secret_key -
CVE-2026-18531
IBM MAS uses axios-1.15.2, protobufjs-8.0.1 and undici-7.26
V. Comments for CVE-2026-81852
No comments yet