CVE-2026-82564: Ash AI Authorization Bypass Vulnerability

CVE-2026-82564 Overview

CVE-2026-82564 is an authorization bypass vulnerability in the ash-project/ash_ai Elixir library affecting versions from 0.6.0 up to 1.0.0. The flaw resides in AshAi.Tool.Execution.identity_filter/3, which constructs update and destroy filters directly from raw tool arguments. A caller of an identity-configured tool can supply a predicate expression, such as {"public_ref": {"not_eq": "<own-ref>"}}, to retarget writes at records they never identified. Combined with Ash.Query.limit(1) and Ash.bulk_update!/Ash.bulk_destroy!, this enables modification or destruction of arbitrary rows, including every row in the table. The issue is tracked as CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact

Authenticated callers can update or destroy arbitrary records in tables exposed by identity-configured AI tools, including every row via omitted keys that yield IS NULL filters.

Affected Products

• ash_ai versions 0.6.0 through < 1.0.0
• Elixir applications using AshAi.Tool.Execution with identity-configured tools
• Ash Framework applications exposing bulk update or destroy actions through AI tool definitions

Discovery Timeline

• 2026-08-31 - CVE-2026-82564 published to NVD
• 2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-82564

Vulnerability Analysis

The ash_ai library exposes Ash Framework actions as tools callable by AI agents. When a tool is configured with an identity, the library builds a filter to scope the write action to the record matching the caller-supplied identity values. The vulnerability arises because identity_filter/3 passes raw argument values directly into Ash.Query.do_filter/2 without type-checking or scalar validation.

Submitting a map value as an identity argument causes Ash.Query.do_filter/2 to interpret the map as a predicate expression rather than a literal equality comparison. An attacker exploits this by sending operators such as not_eq, gt, or other comparison predicates in place of a scalar identifier. The predicate matches records the caller was never authorized to identify.

Additionally, omitting an identity key entirely causes Map.get/2 to return nil, producing an IS NULL filter that matches an arbitrary row. Chained with bulk_update! or bulk_destroy!, the result is unrestricted write access to the underlying data source.

Root Cause

The root cause is missing input validation on identity argument values. The filter construction code assumed scalar inputs but placed no constraint on the argument shape. Ash's filter DSL treats map values as structured predicates, converting untrusted input into query logic. The patched code casts each identity value to the field type and rejects non-scalar inputs.

Attack Vector

Exploitation requires the ability to invoke an identity-configured ash_ai tool. A caller submits crafted JSON arguments where identity fields contain predicate maps instead of scalars. The following patch excerpt shows the fix, which introduces a get_by argument to tool definitions:

   full_filter_schema?: 1,
   full_text: 0,
   full_text: 1,
+  get_by: 1,
   html_path: 1,
   identity: 1,
   load: 1,

Source: GitHub Commit 87f616d

       :async,
       :domain,
       :identity,
+      :get_by,
       :description,
       :action_parameters,
       :arguments,

Source: GitHub Commit 87f616d

Detection Methods for CVE-2026-82564

Indicators of Compromise

• Tool invocation logs containing map-shaped values (JSON objects) submitted for identity fields expected to be scalars.
• Unexpected bulk update or destroy activity on records outside the calling user's ownership scope.
• Ash query logs showing IS NULL predicates generated from AI tool executions where identity arguments were omitted.

Detection Strategies

• Instrument AshAi.Tool.Execution calls to log the JSON schema of incoming tool arguments and alert on non-scalar identity values.
• Compare pre-write and post-write record hashes for actions invoked via ash_ai tools to detect unauthorized modifications.
• Review audit trails for bulk_update! and bulk_destroy! operations correlated with AI tool sessions.

Monitoring Recommendations

• Enable Ash Framework telemetry events for update and destroy actions and forward them to a centralized logging pipeline.
• Alert on any tool invocation where an identity argument contains operators such as not_eq, gt, lt, in, or is_nil.
• Baseline the volume of write operations per authenticated caller and alert on deviations.

How to Mitigate CVE-2026-82564

Immediate Actions Required

• Upgrade ash_ai to version 1.0.0 or later, which enforces scalar casting for identity values.
• Audit application code for tools defined with identity and confirm that no unpatched ash_ai versions remain deployed.
• Review recent write activity for anomalous updates or destroys initiated through AI tool endpoints.

Patch Information

The fix is available in ash_ai1.0.0. The patch casts each identity value to the declared field type and rejects non-scalar inputs, preventing predicate maps from being interpreted as filters. Details are published in GHSA-jg86-xh36-h5xc and the CNA advisory. See also the OSV entry.

Workarounds

• Remove or disable identity-configured tools that expose bulk update or destroy actions until the upgrade is applied.
• Add an application-layer guard that validates tool arguments are scalars before invoking AshAi.Tool.Execution.
• Restrict AI tool invocation to trusted callers and enforce authorization checks on the target record inside the Ash action itself.

# Update ash_ai in mix.exs and fetch the patched release
mix deps.update ash_ai
mix deps.get
mix compile --force