CVE-2026-82586

Received Received - Intake

Improper Protection of Alternate Path in AshLua

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: EEF

Description

Improper Protection of Alternate Path vulnerability in ash-project ash_lua allows a user-supplied Lua script to read attributes that are not on the exposed-field allow-list. AshLua exposes Ash resources to Lua scripts, gated by a manifest declaring which fields are exposed. The read action's operation aggregate path in AshLua.Runtime took the field name straight from the Lua call and resolved it with only String.to_existing_atom and Ash.Query.Aggregate.new!, neither of which consults the exposed-field allow-list the normal fields path enforces. A script can therefore read the value of any attribute of any record the actor may read, including private sensitive?: true columns, via resource.read({ operation = {"list", "hashed_password"} }); min and max give a value oracle. Anyone able to submit or influence a Lua script can reach this. This issue affects ash_lua: from 0.1.0 before 0.2.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-07

Last Modified

2026-09-07

Generated

2026-09-08

AI Q&A

2026-09-08

EPSS Evaluated

N/A

NVD

CVE-2026-82586

Affected Vendors & Products

Vendor	Product	Version / Range
ash-project	ash_lua	From 0.1.0 (inc) to 0.2.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-424	The product does not sufficiently protect all possible paths that a user can take to access restricted functionality or resources.

Attack-Flow Graph

Executive Summary

This vulnerability is an Improper Protection of Alternate Path issue in the ash_lua library. It allows a user-supplied Lua script to read attributes that are not on the exposed-field allow-list. The read action's operation aggregate path in AshLua.Runtime directly uses the field name from the Lua call without checking the allow-list, which normally restricts field access. This means a script can read any attribute of a record the actor can access, including sensitive fields marked as private.

Detection Guidance

This vulnerability involves improper field exposure in ash_lua allowing Lua scripts to read unauthorized attributes. To detect it, inspect Lua scripts for resource.read calls with operation parameters like {list, hashed_password}. Check ash_lua versions between 0.1.0 and 0.2.0 for updates. No direct network commands are provided, but review script permissions and exposed-field manifests.

Impact Analysis

If you use ash_lua versions 0.1.0 to 0.2.0, an attacker who can submit or influence a Lua script could exploit this to read sensitive data like hashed passwords or other private attributes. This could lead to unauthorized data access, credential theft, or further exploitation of the system.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive personal data, violating GDPR's data protection principles and HIPAA's safeguards for protected health information. Organizations using affected versions may face compliance breaches, legal penalties, and reputational damage.

Mitigation Strategies

Upgrade ash_lua to version 0.2.1 or later to address the improper field exposure in AshLua.Runtime. Review Lua scripts for unauthorized field access attempts, especially those querying sensitive attributes like hashed_password.

Hi! I’m here to help you understand CVE-2026-82586. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70