When mounted without :csp_nonce_assign_key, AshAdmin.Router.ash_admin/2 defaulted the img, style, and script nonces to the literal constant ash_admin-Ed55GFnX, which AshAdmin.Layouts wrote verbatim into the nonce attribute of its inline <style> and <script> tags on every response. The value is a compile-time constant published in the repository and is never rotated per request. If an application's CSP script-src allow-lists that documented default, any HTML-injection sink on an admin page can reuse the known nonce to run inline scripts the policy was meant to block. The fix generates a fresh random nonce per request.
This issue affects ash_admin: from 0.10.8 before 1.3.1.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| ash-project | ash_admin | unaffected |
|
||||||
| ash-project | ash_admin | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Mon, 31 Aug 2026 02:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Use of Insufficiently Random Values vulnerability in ash-project ash_admin ships a hardcoded, publicly known CSP nonce, defeating nonce-based Content-Security-Policy protection. When mounted without :csp_nonce_assign_key, AshAdmin.Router.ash_admin/2 defaulted the img, style, and script nonces to the literal constant ash_admin-Ed55GFnX, which AshAdmin.Layouts wrote verbatim into the nonce attribute of its inline <style> and <script> tags on every response. The value is a compile-time constant published in the repository and is never rotated per request. If an application's CSP script-src allow-lists that documented default, any HTML-injection sink on an admin page can reuse the known nonce to run inline scripts the policy was meant to block. The fix generates a fresh random nonce per request. This issue affects ash_admin: from 0.10.8 before 1.3.1. | |
| Title | AshAdmin ships a hardcoded CSP nonce, allowing nonce-based CSP bypass | |
| First Time appeared |
Ash-project
Ash-project ash Admin |
|
| Weaknesses | CWE-330 | |
| CPEs | cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Ash-project
Ash-project ash Admin |
|
| References |
| |
| Metrics |
cvssV4_0
|
MITRE
Status: PUBLISHED
Assigner: EEF
Published:
Updated: 2026-08-31T02:29:14.304Z
Reserved: 2026-08-30T23:15:02.378Z
Link: CVE-2026-81852
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-08-31T03:16:42.500
Modified: 2026-08-31T03:16:42.500
Link: CVE-2026-81852
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-08-31T03:30:05Z
-
CWE-330
Use of Insufficiently Random Values