Sensitive Information Disclosure in Ash Project's Ash_AI

CVE-2026-75760

What is CVE-2026-75760?

A vulnerability in Ash_AI allows for the disclosure of sensitive information, including provider request states and credentials, during user-facing validation errors. Specifically, when an embedding provider call fails in the AshAi.Changes.Vectorize function, the resulting error message may expose critical details such as the request URL, provider response body, and even the outbound Authorization header containing the provider API key. This occurs because the error message generation does not sanitize the raw error term, making it accessible to attackers through oversized or malformed content. The vulnerability affects versions of Ash_AI before 1.0.0, and the fix involves logging the error details securely and returning a generic error message to users.

References