ash_ai CVE-2026-75760

Exploitation requires a low-privilege authenticated session against an application endpoint that uses AshAi.Changes.Vectorize on at least one resource attribute and exposes that resource via AshJsonApi or AshGraphql (confirmed by CVSS PR:L and the description's API rendering path). The attacker must be able to trigger an embedding provider call failure, which the description confirms is reachable via oversized or malformed content in a vectorized field - no further privileged access or special system configuration is needed beyond the presence of the vulnerable library version. Limiting factors: unauthenticated callers (PR:N) cannot exploit this; applications using ash_ai without AshJsonApi or AshGraphql that handle errors internally are not affected; deployments where the embedding provider's HTTP client does not populate the error struct with request metadata (including headers) would leak less sensitive data, though the provider response body would still be exposed.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H) accurately reflects the realistic threat: low-privilege authenticated network access is sufficient, complexity is low, and the confidentiality impact is high due to API key exposure. There is no integrity or availability impact. The absence of a CISA KEV listing and the lack of a known public exploit code lower the urgency somewhat, but the exploitability here is almost trivially low-effort - any authenticated caller who can write to a vectorized field can trigger the disclosure by crafting content that causes a provider error. The CVSS 4.0 score of 7.1 is consistent with this assessment. EPSS data was not provided in the input, so exploitation probability relative to the broader CVE population cannot be quantified; that gap should be filled before finalizing patch prioritization. For organizations running AshJsonApi or AshGraphql endpoints backed by ash_ai with third-party embedding providers, the risk of provider API key leakage is concrete and should be treated as urgent, since a leaked embedding API key can enable unauthorized model usage and associated cost liability entirely separate from the application itself.

An authenticated user submits a resource mutation containing an oversized or deliberately malformed field value to an AshJsonApi or AshGraphql endpoint that uses AshAi.Changes.Vectorize. The embedding provider call fails and returns a structured error including the outbound HTTP request with its Authorization header. The API response returned to the user contains the raw inspected error, including the provider API key prefixed with 'Bearer'. No exploit code repository is known at time of analysis, but this trigger path requires no specialized tooling.