CVE-2026-82586 AshLua read operation aggregate bypasses the exposed-field allow-list, exposing private attributes
A user-supplied Lua script can bypass exposed-field restrictions to read private attributes, including sensitive data like hashed passwords.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-82586?
CVE-2026-82586 is a high-severity vulnerability in ash-project ash_lua, published on 7 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper Protection of Alternate Path vulnerability in ash-project ash_lua allows a user-supplied Lua script to read attributes that are not on the exposed-field allow-list.
AshLua exposes Ash resources to Lua scripts, gated by a manifest declaring which fields are exposed. The read action's operation aggregate path in AshLua.Runtime took the field name straight from the Lua call and resolved it with only String.to_existing_atom and Ash.Query.Aggregate.new!, neither of which consults the exposed-field allow-list the normal fields path enforces. A script can therefore read the value of any attribute of any record the actor may read, including private sensitive?: true columns, via resource.read({ operation = {"list", "hashed_password"} }); min and max give a value oracle. Anyone able to submit or influence a Lua script can reach this.
This issue affects ash_lua: from 0.1.0 before 0.2.1.
Weakness: CWE-424
Which versions are affected by CVE-2026-82586?
1 open source package ship an affected version, including ash_lua.
| Package | Affected | Fixed in |
|---|---|---|
ash_lua Hex | From 0.1.0 | 0.2.1 |
How do I fix CVE-2026-82586?
Upgrade ash_lua to 0.2.1 or later.
Is CVE-2026-82586 being exploited?
There is no known exploitation of CVE-2026-82586 in the wild and no public exploit code.
Sources
Also known as EEF-CVE-2026-82586, GHSA-37jv-wc37-fhcw.