Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-78230— AshAi aggregate tool can read field-policy-protected fields

Quick assessment

Affected
ash-project ash_ai
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

AshAi 将 Ash 的读取操作暴露给语言模型的工具调用。其中的“read”工具接受一种聚合结果类型（min、max、sum、avg），它会针对指定字段构建一个临时的 ，并返回其原始值。 虽然 Ash 的字段策略（field policies）会在返回的记录中遮蔽（redact）被禁止的字段（将其替换为 ），但这种遮蔽机制并不适用于聚合计算后的值。因此，工具调用方可以通过请求某个字段作为聚合值，来读取其当前角色（actor）的字段策略所禁止访问的字段；尤其是 min/max 聚合会直接返回该字段的实际值。这涵盖了

CVSS 6.0 · Medium EPSS 0.25% · P16

Possible ATT&CK Techniques 1 AI

T1078 · Valid Accounts

Affected Version Matrix 2

VendorProduct Version RangeStatus
ash-project ash_ai 0.1.0< 1.0.3 affected
2ba234b50946a3b8116190c8467f9f4dfa5edce7< 9c02de581625c342c9870a672830bff28c1d701e affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-78230

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
AshAi aggregate tool can read field-policy-protected fields
Source: CVE Program / CVE List V5
Vulnerability Description
AshAi exposes Ash read actions to language-model tool calls. The read tool accepts an aggregate result type (min, max, sum, avg) that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value. Ash field policies redact forbidden fields on returned records (replacing them with %Ash.ForbiddenField{}), but that redaction does not apply to aggregate values. A tool caller could therefore read a field the calling actor's field policies forbid by requesting it as an aggregate; min/max in particular return an actual field value. This includes fields that are public? true but restricted per-actor by a field policy, such as sensitive PII. The tool's existing check only required the field to be public, which is a separate axis from per-actor field-policy authorization. The fix authorizes the aggregated field against the resource's field policies, so aggregating over a field the actor may not see is refused or scoped to the rows where it is visible. This issue affects ash_ai: from 0.1.0 before 1.0.3.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1220
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
ash-project ash_ai 0.1.0 ~ 1.0.3 cpe:2.3:a:ash-project:ash_ai:*:*:*:*:*:*:*:*
ash-project ash_ai 2ba234b50946a3b8116190c8467f9f4dfa5edce7 ~ 9c02de581625c342c9870a672830bff28c1d701e cpe:2.3:a:ash-project:ash_ai:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-78230

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-78230

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-78230 (2)

Vendor Advisories for CVE-2026-78230 (1)

News Coverage for CVE-2026-78230 (1)

Other References for CVE-2026-78230 (1)

Same Patch Batch · ash-project · 2026-09-08 · 3 CVEs total

CVE-2026-78216 6.0 MEDIUM AshLua eval read operations can read field-policy-protected fields via aggregates
CVE-2026-82710 2.3 LOW Terminal escape sequence injection in mix usage_rules.search_docs via package documentatio

IV. Related Vulnerabilities

Same product: ash_ai
Same vendor: ash-project
Same weakness: CWE-1220

V. Comments for CVE-2026-78230

No comments yet

Leave a comment