CVE-2026-82564
HighCVSS 7.1Summary
An authorization bypass through user-controlled key vulnerability in ash_ai allows a caller to update or destroy records it never identified, including every row in the table. The identity filter is built directly from raw tool arguments.
Risk Assessment
An attacker can modify or delete data they are not authorized to, potentially leading to data integrity compromise and unauthorized changes.
Recommendation
It is recommended to upgrade ash_ai to version 1.0.0 or later, which includes a fix that casts identity values to the field type and rejects non-scalar inputs.
Other vulnerabilities in ash_ai
See all- CVE-2026-82580Medium
In ash_ai (from 0.6.0 before 1.0.0), a vulnerability allows disclosure of sensitive information in error messages. Exceptions during tool execution are sent to chat users without filtering, potentially revealing internal technical details.
- CVE-2026-82579Medium
In ash_ai (from 0.6.0 before 1.0.0), a vulnerability allows an infinite loop. An attacker who can influence model outputs can hang the tool loop and cause unbounded, repeated model requests.
- CVE-2026-75760High
A vulnerability in ash_ai discloses provider request state and credentials in a user-facing validation error. When the embedding provider call fails, the error contains the raw error term, which may include the URL, response body, and Authorization header with the API key.
- CVE-2026-81315High
An Origin Validation Error vulnerability in ash-project ash_ai allows a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-site requests to a user's local MCP server with that user's actor. With default allowed_origins: nil, origin_allowed?/3 accepts an origin when uri.host == conn.host and the forwarded scheme is https, both attacker-controlled. The issue affects ash_ai from 0.8.0 before 1.0.0.
- CVE-2026-77956Critical
A code injection vulnerability in ash-project ash_ai allows a remote, unauthenticated client to execute arbitrary Elixir code. AshAi.Actions.Prompt evaluates prompt content through EEx.eval_string/2, and when prompt content incorporates request data, attacker-controlled text is compiled and run as an EEx template. This affects ash_ai from 0.1.0 before 1.0.0.
Original NVD description (English source)
Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_ai allows a caller of an identity-configured tool to update or destroy records it never identified, including every row in the table. In AshAi.Tool.Execution, identity_filter/3 built the update/destroy filter directly from the raw tool arguments as [{key, Map.get(arguments, to_string(key))}] and passed it to Ash.Query.do_filter/2. A map value is parsed as a predicate expression rather than a literal, so a caller can send {"public_ref": {"not_eq": "<own-ref>"}} and, combined with Ash.Query.limit(1) and Ash.bulk_update!/Ash.bulk_destroy!, retarget the write at a record it never identified; an omitted key yields an IS NULL filter that matches an arbitrary row. The fix casts each identity value to the field type, rejecting non-scalar inputs. This issue affects ash_ai: from 0.6.0 before 1.0.0.