EEF-CVE-2026-82726
- Source
- https://cna.erlef.org/osv/EEF-CVE-2026-82726.html
- Import Source
- https://cna.erlef.org/osv/EEF-CVE-2026-82726.json
- JSON Data
- https://api.osv.dev/v1/vulns/EEF-CVE-2026-82726
- Aliases
-
- CVE-2026-82726
- GHSA-rpf8-q9jh-qxrr
- Published
- 2026-08-31T03:05:38.612Z
- Modified
- 2026-08-31T03:25:37.895665531Z
- Severity
-
- 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- AshPhoenix get_subdomain maps a crafted or differently-cased Host header to an arbitrary tenant
- Details
-
Summary
Permissive Regular Expression vulnerability in ash-project ash_phoenix lets a remote client select the tenant an Ash application uses, or degrade the request, by sending a crafted Host header.
AshPhoenix.Helpers.get_subdomain/2 stripped the root domain with String.replace(host, ~r/.?#{root_host}/, ""). The root host was interpolated raw, so each . became a wildcard and any metacharacter a pattern, and the replace was global and unanchored, so a match was removed from anywhere in the string. With root_host example.com, Host: foo.exampleXcom.attacker.net returned the tenant foo.attacker.net. A metacharacter-bearing or nil root host degraded the pattern or raised on every request. The comparison was also case-sensitive, so TENANT.EXAMPLE.COM and EXAMPLE.COM slipped past the root-host allowlist. conn.host comes from the client Host header. The fix matches the root host case-insensitively and only as an exact trailing suffix.
This issue affects ash_phoenix: from 2.1.26 before 2.3.25.
Configuration
The application uses subdomain-based multitenancy via AshPhoenix.Helpers.get_subdomain/2 (for example through AshPhoenix.LiveView.SubdomainHook) to select the tenant from the request host.
- Database specific
{ "cpe_ids": [ "cpe:2.3:a:ash-project:ash_phoenix:*:*:*:*:*:*:*:*" ], "capec_ids": [ "CAPEC-153" ], "cwe_ids": [ "CWE-625", "CWE-178" ] }- References
- Credits
-
-
- Peter Ullrich - FINDER
-
- Peter Ullrich - REPORTER
-
- Zach Daniel / Ash Project - REMEDIATION_DEVELOPER
-
- Jonatan Männchen / EEF - COORDINATOR
-
Affected packages
Hex / ash_phoenix
Package
- Name
- ash_phoenix
- Purl
- pkg:hex/ash_phoenix