CVE-2026-75760 in ash_ai
Summary
by MITRE • 08/31/2026
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_ai discloses provider request state and credentials in a user-facing validation error.
In AshAi.Changes.Vectorize, when the embedding provider call fails the change added a changeset error whose message inspected the raw error term (An error occurred while generating embeddings: #{inspect(error)}). A plain-string add_error produces an Ash.Error.Changes.InvalidChanges in the :invalid class, which AshJsonApi and AshGraphql render back to the caller. The embedding client's error term is not sanitized, so it can carry the request URL, the provider response body, and, for HTTP clients that keep the request in the error struct, the outbound Authorization header with the provider API key. Failures are attacker-reachable via oversized or malformed vectorized content. The fix logs the raw error and returns a generic message.
This issue affects ash_ai: from 0.1.0 before 1.0.0.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/31/2026
The vulnerability identified in AshAi, specifically within the version range from 0.1.0 up to but not including 1.0.0, represents a critical information disclosure flaw rooted in improper error handling and logging practices. This issue manifests when the system attempts to generate vector embeddings through an external provider. The core technical failure occurs in the AshAi.Changes.Vectorize module, where the application catches exceptions arising from failed embedding requests. Instead of sanitizing these errors before presenting them to the end-user or API consumer, the code directly inspects and includes the raw error term within a user-facing validation message using an interpolation pattern that exposes internal state details. This design choice violates fundamental security principles regarding secure error handling, leading to the leakage of sensitive operational data through standard application interfaces such as AshJsonApi and AshGraphql.
From a technical perspective, the vulnerability allows for the exfiltration of high-value credentials and network topology information. When an embedding provider call fails due to malformed input or oversized content, which are easily triggerable by an attacker, the resulting error struct often contains comprehensive details about the failed HTTP transaction. This includes the full request URL, potentially revealing internal service endpoints or API structures, as well as the response body from the provider. Most critically, if the underlying HTTP client implementation retains the original request object within the error structure, it may also include outbound Authorization headers containing valid API keys and authentication tokens for third-party embedding services. This transforms a simple validation failure into a significant credential theft vector, enabling attackers to compromise external service accounts or map internal network architectures based on exposed endpoint patterns.
The operational impact of this vulnerability is severe, as it facilitates both reconnaissance and unauthorized access to downstream services. An attacker can systematically send malformed requests to trigger these error states, thereby harvesting API keys that grant access to expensive machine learning resources or sensitive data processing capabilities. Furthermore, the exposure of request URLs aids in mapping the application's integration points with external AI providers, which can inform further targeted attacks against those specific endpoints. This aligns closely with CWE-209, which describes the generation of an error message that includes sensitive information, and CWE-532, concerning information exposure through log files if similar patterns exist elsewhere in the codebase. In terms of offensive security frameworks, this behavior corresponds to ATT&CK technique T1589, specifically Credential Harvesting via Error Messages, as it leverages application feedback mechanisms to extract authentication material without direct exploitation of logic flaws beyond input validation boundaries.
To mitigate this vulnerability, developers must implement strict error sanitization protocols before any exception data is returned to the client side. The recommended fix involves decoupling internal diagnostic information from user-facing responses by logging raw errors securely on the server while returning a generic, non-descriptive message such as "An error occurred while generating embeddings" to the caller. This approach ensures that debugging details remain available for system administrators through secure log channels but are never exposed over network interfaces accessible to untrusted users. Additionally, it is advisable to audit all other areas of the application where external API calls are made to ensure consistent handling of failure states across the entire codebase, preventing similar leaks in different modules. Regular security reviews focusing on error message content and adherence to secure coding standards for information disclosure will further reduce the risk profile associated with integrating third-party AI services.