EEF-CVE-2026-78230 CVE-2026-78230 GHSA-v5rw-36x5-r5vx
AshAi aggregate tool can read field-policy-protected fields
- Severity
- 0.0 / 10
- Unknown · CVSS 4.0
- Exploit chance (EPSS)
- 0.43%
- Chance of exploitation in the next 30 days. Higher than 37.02% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-1220 Insufficient Granularity of Access Control
- Fix
1.0.3- Upgrade ash_ai to this version or later
Description
Summary
AshAi exposes Ash read actions to language-model tool calls. The read tool accepts an aggregate result type (min, max, sum, avg) that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value.
Ash field policies redact forbidden fields on returned records (replacing them with %Ash.ForbiddenField{}), but that redaction does not apply to aggregate values. A tool caller could therefore read a field the calling actor's field policies forbid by requesting it as an aggregate; min/max in particular return an actual field value. This includes fields that are public? true but restricted per-actor by a field policy, such as sensitive PII. The tool's existing check only required the field to be public, which is a separate axis from per-actor field-policy authorization.
The fix authorizes the aggregated field against the resource's field policies, so aggregating over a field the actor may not see is refused or scoped to the rows where it is visible.
This issue affects ash_ai: from 0.1.0 before 1.0.3.
Configurations
Reachable only when an application exposes an AshAi read tool over a resource whose field policies restrict a field that the calling actor can still name as an aggregate (for example a public? true but field-policy-protected attribute).
Affected versions
Hex
| Package | Vulnerable | Fixed in |
|---|---|---|
| ash_ai | >= 0.1.0, < 1.0.3 |
1.0.3 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
ash_ai Hex → 1.0.3
- mix
{:ash_ai, "~> 1.0.3"} # then: mix deps.update ash_ai
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- Present
- Privileges required
- Low
- User interaction
- None
- Confidentiality (vulnerable system)
- High
- Integrity (vulnerable system)
- None
- Availability (vulnerable system)
- None
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
Weakness
CWE-1220: Insufficient Granularity of Access Control
The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.
How to prevent it
- Architecture and Design, Implementation, Testing: Access-control-policy protections must be reviewed for design inconsistency and common weaknesses. Access-control-policy definition and programming flow must be tested in pre-silicon, post-silicon testing.
References
Advisories
Fixes and patches
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| EEF-CVE-2026-75760 AshAi vectorize change leaks raw embedding-provider errors, including credentials, in a user-facing error | Not rated yet | Also affects ash_ai |
| EEF-CVE-2026-82580 AshAi echoes raw tool exception messages into the conversation, disclosing internal details | Not rated yet | Also affects ash_ai |
| EEF-CVE-2026-82579 AshAi tool loop never terminates when all tool calls are filtered out, enabling denial of service | Not rated yet | Also affects ash_ai |
| EEF-CVE-2026-82564 Identity tool filter in AshAi accepts operator maps, allowing update or destroy of unidentified records | Not rated yet | Also affects ash_ai |
| EEF-CVE-2026-81315 MCP DNS-rebinding origin check in AshAi is bypassed by a spoofed X-Forwarded-Proto header | Not rated yet | Also affects ash_ai |
| EEF-CVE-2026-77956 EEx template evaluation of prompt content in AshAi enables remote code execution | Not rated yet | Also affects ash_ai |
| DRUPAL-CONTRIB-2026-167 The Webform module enables site builders to create forms and collect submissions. | Medium | Same weakness, CWE-1220 |
| EEF-CVE-2026-86338 Ash field policies do not filter-nil forbidden calculations and aggregates, enabling an information-disclosure oracle | Not rated yet | Same weakness, CWE-1220 |
Credits: Aaron Hong / Remedy, Jonatan Männchen / EEF, Zach Daniel / Ash Project
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor