CVE-2026-82564
Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_ai allows a caller of an identity-configured tool to update or destroy records it never identified, including every row in the table.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.31%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_ai allows a caller of an identity-configured tool to update or destroy records it never identified, including every row in the table. In AshAi.Tool.Execution, identity_filter/3 built the update/destroy filter directly from the raw tool arguments as [{key, Map.get(arguments, to_string(key))}] and passed it to Ash.Query.do_filter/2. A map value is parsed as a predicate expression rather than a literal, so a caller can send {"public_ref": {"not_eq": "<own-ref>"}} and, combined with Ash.Query.limit(1) and Ash.bulk_update!/Ash.bulk_destroy!, retarget the write at a record it never identified; an omitted key yields an IS NULL filter that matches an arbitrary row. The fix casts each identity value to the field type, rejecting non-scalar inputs. This issue affects ash_ai: from 0.6.0 before 1.0.0.
- CVSS 4.0
- 7.1 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.31% probability · 24th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-639
- Source
- 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
References
- https://cna.erlef.org/cves/CVE-2026-82564.html
- https://github.com/ash-project/ash_ai/commit/87f616d5bfbf7af43346f0701ae17f853789a602
- https://github.com/ash-project/ash_ai/security/advisories/GHSA-jg86-xh36-h5xc
- https://osv.dev/vulnerability/EEF-CVE-2026-82564
- https://github.com/ash-project/ash_ai/security/advisories/GHSA-jg86-xh36-h5xc
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.