ash_ai CVE-2026-78230

Two specific conditions must both be true: (1) the deployment uses ash_ai's read tool to expose at least one Ash resource to LLM tool calls (ash_ai 0.1.0-1.0.3 must be installed and the read tool must be wired up); and (2) Ash field policies must be configured to restrict specific fields for at least one actor role - the bypass only yields unauthorized data when a field policy would have redacted a value for the calling actor. The attacker must have low-privilege authenticated access sufficient to invoke the LLM tool (PR:L). The attack is limited to fields that are marked public? true but actor-restricted by policy; fully private fields (public? false) are rejected by the existing public-field check. No special network position is required beyond ability to send tool-call requests.

Real-world risk is moderate and tightly scoped. The CVSS 4.0 score of 6.0 with vector AV:N/AC:L/AT:P/PR:L reflects the key constraints: the attack requires low-privilege authenticated access (PR:L) and a specific deployment precondition (AT:P) - field policies must be configured to restrict particular fields for the calling actor, which is a non-default configuration requiring deliberate policy authorship. Without field policies, there is nothing to bypass. Confidentiality impact is high (VC:H) when conditions are met, since min/max aggregates return actual field values that would otherwise be redacted, making PII exfiltration realistic. No CISA KEV listing exists and no public exploit code has been identified, keeping practical exposure low for now. EPSS data was not provided. The affected library is niche (Elixir/LLM integrations), but deployments that do use ash_ai to expose sensitive Ash resources to LLM workflows while relying on field policies for data segregation should treat patching as urgent - those are exactly the high-value targets where the bypass matters most.

An authenticated actor with restricted field policies - for example, a customer service agent whose field policy blocks access to the salary or ssn field - invokes the ash_ai LLM read tool requesting result_type aggregate with kind 'min' or 'max' over the restricted field name. The tool bypasses field-policy evaluation, computes and returns the actual field value from the database, and the actor receives sensitive PII they are not authorized to view. No exploit code has been publicly released, but the technique is straightforward for any caller aware of the aggregate API.