CVE-2026-75760: Ash AI Information Disclosure Vulnerability

CVE-2026-75760 Overview

CVE-2026-75760 is an information disclosure vulnerability in the ash-project/ash_ai library affecting versions 0.1.0 through versions before 1.0.0. The flaw resides in AshAi.Changes.Vectorize, where a failed embedding provider call generates a changeset error that inlines the raw error term with inspect(error). That error bubbles up through AshJsonApi and AshGraphql and is returned to the API caller. The unsanitized error term can carry the outbound request URL, the provider response body, and the Authorization header containing the provider API key. Attackers trigger the leak by submitting oversized or malformed content to any vectorized field. The issue is tracked under CWE-209: Generation of Error Message Containing Sensitive Information.

Critical Impact
A low-privileged, network-reachable attacker can extract embedding provider API keys and internal request metadata by forcing embedding failures through crafted input.

Affected Products

ash_ai versions 0.1.0 through versions before 1.0.0
Elixir applications exposing vectorized resources via AshJsonApi
Elixir applications exposing vectorized resources via AshGraphql

Discovery Timeline

2026-08-31 - CVE-2026-75760 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-75760

Vulnerability Analysis

The defect lives in lib/ash_ai/changes/vectorize.ex. When the embedding model client returns an error tuple, the change calls add_error/2 with a message built by interpolating the raw error term: "An error occurred while generating embeddings: #{inspect(error)}". A string passed to add_error produces an Ash.Error.Changes.InvalidChanges in the :invalid class. Both AshJsonApi and AshGraphql treat :invalid errors as user-facing validation failures and render them back to the API caller.

The embedding client's error term is not sanitized before it is inspected. HTTP clients commonly used in the Elixir ecosystem embed the full Req.Request or equivalent struct inside error structs, including request headers. That struct carries the provider hostname, path, request body, response body, and the outbound Authorization: Bearer <api-key> header used to authenticate to the embedding provider.

Root Cause

The root cause is unsanitized error propagation from an outbound service call into a user-facing validation error. inspect/1 serializes arbitrary Erlang terms verbatim, so any secret present in the error term is emitted into the response body without redaction or classification.

Attack Vector

Exploitation requires only an authenticated API session that can write to a resource with a vectorized attribute. The attacker submits oversized or malformed content that causes the embedding provider to reject the request, or forces a downstream failure such as a timeout. The resulting error is returned in the JSON:API or GraphQL response, exposing the request URL, response body, and provider API key. Once the key is captured, the attacker can call the embedding provider directly and incur charges or access model quotas billed to the victim.

text

 use Ash.Resource.Change
 
+  require Logger
+
   def change(changeset, _opts, _context) do
     {embedding_model, vector_opts} =
       AshAi.Info.vectorize_embedding_model!(changeset.resource)

Source: GitHub Commit 088a2562. The patch adds Logger and replaces the interpolated error message with a generic response, keeping the raw error only in server-side logs.

Detection Methods for CVE-2026-75760

Indicators of Compromise

API responses from AshJsonApi or AshGraphql endpoints containing substrings such as Authorization, Bearer, api_key, or provider hostnames like api.openai.com inside validation error messages.
Repeated write requests to vectorized resource fields with abnormally large payloads or content designed to fail tokenization.
Outbound embedding provider usage anomalies, including unexpected traffic sources or spikes tied to leaked keys.

Detection Strategies

Inspect application logs and web-tier response bodies for the string An error occurred while generating embeddings: returned to clients.
Add data loss prevention rules that flag responses containing Bearer tokens or provider API key prefixes leaving the application.
Correlate 4xx validation error volume against embedding provider error rates to spot exploitation attempts.

Monitoring Recommendations

Enable alerting on the embedding provider's usage dashboard for unusual request origins or geographic patterns.
Monitor the dependency manifest (mix.exs, mix.lock) for ash_ai versions below 1.0.0 across all Elixir services.
Track new API key issuance and revocation events to confirm rotation compliance after patching.

How to Mitigate CVE-2026-75760

Immediate Actions Required

Upgrade ash_ai to version 1.0.0 or later across all Elixir applications that use AshAi.Changes.Vectorize.
Rotate every embedding provider API key that was configured in an affected deployment, treating prior keys as compromised.
Review historical application logs and web access logs for exposed keys and revoke any credentials found in error payloads.

Patch Information

The fix landed in commit 088a2562e16d65f36cec178070de683636479f58 and is included in ash_ai1.0.0. The patch logs the raw error server-side via Logger and returns a generic validation message to API callers. Additional details are available in the GitHub Security Advisory GHSA-p5cr-mmmf-6w39 and the Erlang Ecosystem Foundation CNA record.

Workarounds

Wrap the vectorize change with a custom module that catches embedding errors and substitutes a generic message before the changeset error is added.
Restrict inbound payload sizes on vectorized fields at the API gateway to reduce the frequency of forced provider failures.
Configure AshJsonApi and AshGraphql error renderers to strip fields matching provider key patterns from :invalid class errors.

bash

# Upgrade ash_ai to the patched release
mix deps.update ash_ai
grep -R "ash_ai" mix.lock
# Confirm the resolved version is >= 1.0.0, then rotate provider keys
mix deps.get