Information Disclosure in AshAi by Ash Project

CVE-2026-78230

What is CVE-2026-78230?

The AshAi library exposes a serious vulnerability that allows unauthorized access to sensitive data through aggregate queries. The read tool can accept aggregated result types like min, max, sum, and avg on specified fields, potentially revealing restricted data, including personally identifiable information (PII), that should be kept confidential based on actor-specific field policies. Despite redaction mechanisms for forbidden fields, the aggregation function permits a breach of privacy by returning actual values from fields that should not be accessible. The issue has been addressed by updating the authorization checks to ensure that aggregate field access aligns with a resource's field policies, preventing unauthorized queries.

References