CVE-2026-82564

ash-project ash_ai, the Elixir package that exposes Ash Framework resources as tools for AI agents, is vulnerable to an authorization bypass through user-controlled key (CWE-639) in versions 0.6.0 through before 1.0.0. The identity_filter/3 function in AshAi.Tool.Execution built the scoping filter for tool-driven updates and deletes directly from raw tool arguments without type-casting, so a map-shaped argument such as {"public_ref": {"not_eq": " "}} is parsed as a predicate expression rather than a literal, and an omitted key yields an IS NULL filter. Combined with Ash.Query.limit(1) and bulk update/destroy operations, a caller can retarget the write at a record it never identified — potentially any row, and with bulk operations every row in the affected table. An attacker who is legitimately able to invoke such a tool gains unauthorized modification or deletion of arbitrary records (high integrity impact, CVSS 4.0 score 7.1). No public proof-of-concept, CISA KEV listing, or in-the-wild exploitation is known; EPSS puts the 30-day exploitation probability at about 0.3%.

What to do: Upgrade ash_ai to 1.0.0 or later, where identity values are cast to the field's type and non-scalar inputs are rejected. In the meantime, audit any AI tools that perform identity-scoped updates or destroys on sensitive tables and restrict which callers can invoke them. Applications on affected versions should treat tool callers as potentially able to modify or delete any row in targeted tables.