AEV-2026-0013
AshAi identity filter let a caller retarget an update or destroy tool (CVE-2026-82564)
AshAi's identity_filter built an update or destroy tool's target filter directly from a raw tool argument, so a nested comparison value in place of a scalar identifier retargeted the operation at a different record. Disclosed by the ash-project maintainers, patched in AshAi 1.0.0 the same day, with no evidence of exploitation before the fix.
Affected
- Organisation
- ash-project (AshAi)
- Product
- AshAi
- Component
- identity_filter in AshAi.Tool.Execution, the update and destroy tool target resolution path
- Versions
- AshAi 0.6.0 and later, before 1.0.0
- Configurations
- An identity configured update or destroy tool reachable by a caller, demonstrated over AshAi's MCP router
Execution authority facts
Fields the evidence does not establish are shown as unknown rather than guessed.
- Intended task
- A caller invokes an identity configured update or destroy tool naming its own record by a scalar identity value
- Agent
- A tool calling client, demonstrated as an ordinary MCP JSON RPC tools call request
- Delegating actor
- The application operator who exposed the identity configured tool
- Action
- Updated a record other than the one the caller's identity argument named
- Target resource
- Any record of the exposed resource reachable through the identity attribute's filter, not only the one the caller identified
- Environment
- An Ash application exposing the tool, demonstrated through AshAi.Mcp.Router in the maintainers' own reproduction
- Credentials used
- unknown
- Privileges available
- Whatever the identity configured tool was itself authorized to update or destroy, applied to a broader or different record than intended
- Authority presented
- Authority to update or destroy the one record its own identity argument names
- Authority required
- Authority over the specific record or records the operation actually resolves against
- Applicable policy
- The tool's identity configuration, naming the attribute meant to address the target record
- Approval mechanism
- none
- Required approver
- unknown
- Independent approval
- no
- Action binding
- The identity argument was meant to bind the operation to one record; a nested comparison value let the same argument bind it to a different record instead
- Sequence context
- unknown
Impact
- Consequence
- Unauthorized update of a record other than the one identified, with the same mechanism extending to destroy and, combined with a bulk operation, to any row of the table
- Reach
- organisational
- Reversibility
- unknown
- Detectability
- silent
- Propagation
- potential
- Recovery
- unknown, no recovery or reversal mechanism described beyond the code fix itself
Evidence
Primary sources
- Broken access control in AshAi.Tool.Execution identity filter in ash-project/ash_ai allows updating or destroying arbitrary records via a nested JSON operand (ash-project (GitHub Security Advisory GHSA-jg86-xh36-h5xc))
Supporting sources
- ash_ai, lib/ash_ai/tool/execution.ex at tag v0.8.2 (last release before the fix) (ash-project/ash_ai (GitHub))
- ash_ai, lib/ash_ai/tool/execution.ex at tag v1.0.0 (patched) (ash-project/ash_ai (GitHub))
- chore: release version v1.0.0 (ash-project/ash_ai (GitHub))
- Reproduction status
- Demonstrated by the maintainers as a reproducible proof of concept over AshAi's MCP router; not independently executed by Moona Intelligence against a running deployment
- Evidence state
- Confirmed
Known unknowns
- Whether this was exploited against a real deployment before the patch, beyond the maintainers' own proof of concept.
- What share of AshAi deployments before 1.0.0 exposed an identity configured update or destroy tool to an untrusted caller.
Limitations
- Moona Intelligence verified the vulnerable and patched source directly but did not execute the proof of concept against a running AshAi application.
Claim provenance
- verified
The maintainers' own security advisory, read directly, states the vulnerable identity_filter behavior, the worked proof of concept, the CVE identifier, CVSS score, CWE classification, and the affected and patched version ranges.
The Agent Was Allowed to Update One Record. The Tool Let It Choose the Set. - verified
Direct comparison of the vulnerable and patched source confirms the raw argument value was passed unmodified into the filter and expression builders before the fix, and cast to the resource field's own type through a new identity_value helper after it.
The Agent Was Allowed to Update One Record. The Tool Let It Choose the Set.