CVE-2026-78230: AshAi Information Disclosure Vulnerability

CVE-2026-78230 Overview

CVE-2026-78230 is an information disclosure vulnerability in AshAi, a library that exposes Ash Framework read actions to language-model tool calls. The read tool accepts an aggregate result type (min, max, sum, avg) that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value. Ash field policies normally redact forbidden fields on returned records by replacing them with %Ash.ForbiddenField{}, but that redaction does not apply to aggregate values. A tool caller can read a field the calling actor's field policies forbid by requesting it as an aggregate. The issue affects ash_ai from version 0.1.0 before 1.0.3.

Critical Impact
A language-model tool caller can bypass per-actor field policies and read sensitive PII by requesting restricted fields as min or max aggregates, which return actual field values.

Affected Products

ash_ai versions 0.1.0 through 1.0.2
Ash Framework applications exposing read actions to LLM tool calls via AshAi
Deployments relying on Ash field policies to gate per-actor access to public fields

Discovery Timeline

2026-09-08 - CVE-2026-78230 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-78230

Vulnerability Analysis

The vulnerability is an insufficient granularity of access control issue [CWE-1220] in the AshAi aggregate tool path. AshAi surfaces Ash read actions to language models so that an LLM can query resources through structured tool calls. The read tool supports an aggregate mode that computes min, max, sum, or avg over a named field and returns the resulting scalar to the caller.

Ash Framework enforces per-record redaction through field policies. When a returned record contains a field the calling actor is not authorized to see, Ash substitutes an %Ash.ForbiddenField{} marker. This redaction path only runs for records, not for aggregate scalar results returned by Ash.aggregate/2.

The tool's pre-check only required the target field to be marked public? true. Public visibility is a schema-level property distinct from per-actor field policy authorization. An attacker who can invoke the tool can therefore request min or max over a restricted field and receive an actual value from a matching row, effectively leaking sensitive PII the actor should never see.

Root Cause

The root cause is a missing authorization check on aggregated fields. The aggregate query bypassed field policies because Ash.aggregate/2 was invoked without the authorize_fields?: true option. Field-level authorization was decoupled from the aggregate computation path, so field policies were consulted for record projections but not for aggregate inputs.

Attack Vector

An authenticated actor with low privileges that is permitted to call the AshAi read tool crafts a tool invocation requesting aggregate_kind: :min (or :max) against a field the actor's field policies forbid. The Ash query executes without field-level authorization on the aggregate, and the scalar result is returned verbatim to the tool caller and, by extension, to the language model context.

elixir

// Patch: fix/authorize aggregated fields in the aggregate tool
// Source: https://github.com/ash-project/ash_ai/commit/9c02de581625c342c9870a672830bff28c1d701e

    query
    |> Ash.Query.unset([:limit, :offset])
-   |> Ash.aggregate({:aggregate_result, aggregate_kind, field: field.name})
+   |> Ash.aggregate({:aggregate_result, aggregate_kind, field: field.name},
+     authorize_fields?: true
+   )
    |> case do
      {:ok, %{aggregate_result: value}} -> value
      {:error, error} -> raise Ash.Error.to_error_class(error)

Detection Methods for CVE-2026-78230

Indicators of Compromise

Tool-call logs showing AshAi read actions with aggregate_kind of min or max targeting fields flagged as sensitive by field policies.
Repeated aggregate queries by the same actor iterating over filters that would narrow a min/max to a single row (a classic disclosure pattern).
LLM conversation transcripts referencing field values the calling actor should not be able to see.

Detection Strategies

Enable Ash query telemetry and log all aggregate calls originating from AshAi tools, including actor, resource, field name, and aggregate kind.
Compare requested aggregate fields against each resource's field policy definitions and alert when a restricted field is aggregated by an unauthorized actor.
Review historical LLM tool-call audit trails for aggregate requests that predate the upgrade to ash_ai 1.0.3.

Monitoring Recommendations

Instrument the Ash.aggregate/2 code path with structured logs that capture actor identity and field authorization outcomes.
Forward AshAi tool invocation records into a centralized data lake for retention and correlation with authentication events.
Alert on unusual bursts of aggregate queries against resources containing regulated data such as PII, PHI, or financial fields.

How to Mitigate CVE-2026-78230

Immediate Actions Required

Upgrade ash_ai to version 1.0.3 or later, which passes authorize_fields?: true to Ash.aggregate/2 in the tool execution path.
Audit exposed AshAi tools and remove or restrict any read tools that expose resources containing sensitive fields until the upgrade is complete.
Rotate or invalidate any secrets, tokens, or credentials that may have been disclosed via aggregate leakage since AshAi was deployed.

Patch Information

The fix landed in commit 9c02de581625c342c9870a672830bff28c1d701e in the ash-project/ash_ai repository and is included in ash_ai 1.0.3. The patch authorizes the aggregated field against the resource's field policies, so aggregating over a field the actor may not see is either refused or scoped to the rows where that field is visible. See the GitHub Security Advisory GHSA-v5rw-36x5-r5vx and the CNA advisory for full details.

Workarounds

Disable the aggregate result type in AshAi read tools until the upgrade is applied.
Narrow the set of fields exposed to AshAi tools by marking sensitive fields public? false at the schema level rather than relying solely on field policies.
Restrict which actors can invoke AshAi tools using upstream authorization at the application or API gateway layer.

bash

# Update ash_ai to a patched release in mix.exs
# {:ash_ai, "~> 1.0", override: true}  # ensure >= 1.0.3

mix deps.update ash_ai
mix deps.get
mix compile --force