CVE-2026-82586

CVE-2026-82586 is an improper-protection-of-alternate-path flaw (CWE-424) in the ash_lua package for the Ash Framework, affecting versions from 0.1.0 before 0.2.1, with a CVSS 4.0 base score of 8.2 (High). AshLua exposes Ash resources to Lua scripts through a manifest declaring which fields are exposed, but the read action's operation aggregate path in AshLua.Runtime takes the field name straight from the Lua call and resolves it with only String.to_existing_atom and Ash.Query.Aggregate.new!, never consulting the exposed-field allow-list that the normal fields path enforces. An attacker who can submit or influence a Lua script can therefore read the value of any attribute of any record the actor is permitted to read, including private columns marked sensitive, with aggregate operations such as min or max serving as a value oracle. This yields disclosure of confidential data (for example password hashes) but no integrity or availability impact, and exploitation requires access to an AshLua-enabled application where the attacker can control script content. No public proof-of-concept or in-the-wild exploitation is known; the flaw is not in CISA KEV and EPSS estimates roughly a 0.3% probability of exploitation within 30 days.

What to do: Upgrade ash_lua to 0.2.1 or later. Until patched, audit and restrict submitted Lua scripts so field names are not passed into aggregate operations (or disable AshLua-backed read paths), and review whether sensitive attributes such as hashed_password could have been read by scripts already executed.