CVE-2026-75760
HighCVSS 7.1Summary
A vulnerability in ash_ai discloses provider request state and credentials in a user-facing validation error. When the embedding provider call fails, the error contains the raw error term, which may include the URL, response body, and Authorization header with the API key.
Risk Assessment
An attacker can obtain sensitive information such as API keys, potentially leading to unauthorized access to external services and security breaches.
Recommendation
It is recommended to upgrade ash_ai to version 1.0.0 or later, which includes a fix that logs the raw error and returns a generic message.
Other vulnerabilities in ash_ai
See all- CVE-2026-82580Medium
In ash_ai (from 0.6.0 before 1.0.0), a vulnerability allows disclosure of sensitive information in error messages. Exceptions during tool execution are sent to chat users without filtering, potentially revealing internal technical details.
- CVE-2026-82579Medium
In ash_ai (from 0.6.0 before 1.0.0), a vulnerability allows an infinite loop. An attacker who can influence model outputs can hang the tool loop and cause unbounded, repeated model requests.
- CVE-2026-82564High
An authorization bypass through user-controlled key vulnerability in ash_ai allows a caller to update or destroy records it never identified, including every row in the table. The identity filter is built directly from raw tool arguments.
- CVE-2026-81315High
An Origin Validation Error vulnerability in ash-project ash_ai allows a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-site requests to a user's local MCP server with that user's actor. With default allowed_origins: nil, origin_allowed?/3 accepts an origin when uri.host == conn.host and the forwarded scheme is https, both attacker-controlled. The issue affects ash_ai from 0.8.0 before 1.0.0.
- CVE-2026-77956Critical
A code injection vulnerability in ash-project ash_ai allows a remote, unauthenticated client to execute arbitrary Elixir code. AshAi.Actions.Prompt evaluates prompt content through EEx.eval_string/2, and when prompt content incorporates request data, attacker-controlled text is compiled and run as an EEx template. This affects ash_ai from 0.1.0 before 1.0.0.
Original NVD description (English source)
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_ai discloses provider request state and credentials in a user-facing validation error. In AshAi.Changes.Vectorize, when the embedding provider call fails the change added a changeset error whose message inspected the raw error term (An error occurred while generating embeddings: #{inspect(error)}). A plain-string add_error produces an Ash.Error.Changes.InvalidChanges in the :invalid class, which AshJsonApi and AshGraphql render back to the caller. The embedding client's error term is not sanitized, so it can carry the request URL, the provider response body, and, for HTTP clients that keep the request in the error struct, the outbound Authorization header with the provider API key. Failures are attacker-reachable via oversized or malformed vectorized content. The fix logs the raw error and returns a generic message. This issue affects ash_ai: from 0.1.0 before 1.0.0.