CVE-2026-82564

Name of the Vulnerable Software and Affected Versions ash ai versions 0.6.0 through 0.9.x

Description An authorization bypass exists in the ash ai project that allows a caller of an identity-configured tool to update or destroy records they are not authorized to access, potentially affecting every row in a table. In AshAi.Tool.Execution, the identity filter/3 function constructs update or destroy filters using raw tool arguments and passes them to Ash.Query.do filter/2. Because map values are parsed as predicate expressions instead of literals, an attacker can provide a map such as {"public ref": {"not eq": "<own-ref>"}} to retarget the write operation. Additionally, omitting a key results in an IS NULL filter that matches arbitrary rows. This occurs when combined with Ash.Query.limit(1) and Ash.bulk update!/Ash.bulk destroy!.

Recommendations Update ash ai to version 1.0.0 or later.