AIKIDO-2026-352021
ash_ai is vulnerable to Improper Authorization
60
Medium Risk
This Affects:
ash_aiTL;DR
The aggregate tool in ash_ai exposes Ash read actions to language-model tool calls and computes min, max, sum, and avg aggregates over a named field after checking only that the field is public. Ash field policies that redact per actor forbidden fields on returned records (replacing them with %Ash.ForbiddenField{}) are not applied to these aggregate values, so a tool caller requests a policy-protected field as an aggregate and reads data the actor may not see, with min/max returning an actual stored value such as public-but-restricted PII. The patch passes authorize_fields?: true to the aggregate query so aggregating over a field the actor cannot see is refused or scoped to the rows where it is visible.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you expose Ash read actions as language-model tools on resources that rely on field policies to restrict access to some fields.
Background info
ash_ai is vulnerable to Improper Authorization in versions 0.1.0 - 1.0.2.
How to fix this
Upgrade the ash_ai library to the patch version.
Links
Fix Commits
github.com/ash-project/ash_ai/commit/2ba234b50946a3b8116190c8467f9f4dfa5edce7github.com/ash-project/ash_ai/commit/9c02de581625c342c9870a672830bff28c1d701e
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.