CVE-2026-75760
Received Received - Intake

Information Disclosure in Ash.AI Provider Error Messages

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: EEF

Description
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_ai discloses provider request state and credentials in a user-facing validation error. In AshAi.Changes.Vectorize, when the embedding provider call fails the change added a changeset error whose message inspected the raw error term (An error occurred while generating embeddings: #{inspect(error)}). A plain-string add_error produces an Ash.Error.Changes.InvalidChanges in the :invalid class, which AshJsonApi and AshGraphql render back to the caller. The embedding client's error term is not sanitized, so it can carry the request URL, the provider response body, and, for HTTP clients that keep the request in the error struct, the outbound Authorization header with the provider API key. Failures are attacker-reachable via oversized or malformed vectorized content. The fix logs the raw error and returns a generic message. This issue affects ash_ai: from 0.1.0 before 1.0.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-75760
EUVD
EUVD-2026-68309

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ash-project ash_ai to 1.0.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-209 The product generates an error message that includes sensitive information about its environment, users, or associated data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves the disclosure of sensitive information in error messages. When the Ash AI library's embedding provider call fails, it generates a user-facing error that includes raw details like API keys, request URLs, and response bodies. These details are exposed because the error message is not sanitized before being sent to the caller via AshJsonApi or AshGraphql.

Detection Guidance

Check if your system uses ash_ai versions between 0.1.0 and 1.0.0. Inspect error logs for embedding provider failures that expose sensitive details like API keys or URLs in user-facing messages. Look for oversized or malformed vectorized content submissions that trigger provider errors.

Impact Analysis

Attackers could exploit this by submitting malformed content to trigger provider failures, causing sensitive data like API keys to leak in error responses. This could lead to unauthorized access to systems, data breaches, or further attacks using exposed credentials.

Compliance Impact

This vulnerability could violate GDPR and HIPAA by exposing sensitive personal or health data in error messages. GDPR requires protecting personal data, while HIPAA mandates safeguarding protected health information. Unauthorized disclosure risks legal penalties and reputational damage.

Mitigation Strategies

Upgrade ash_ai to version 1.0.0 or later. Ensure error messages are sanitized to avoid exposing sensitive provider details. Review and update logging practices to capture raw errors internally without leaking them to users.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75760. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart