CVE-2026-82586 ash-project CVE debrief

Who should care

Defenders and developers using ash_lua, especially those handling Lua scripts and attribute access controls, should assess exposure and verify version. They should verify exposure in ash_lua versions from 0.1.0 before 0.2.1; assess Lua script handling and attribute access controls. They should also review and update ash_lua to version 0.2.1 or later if vulnerable.

Why it matters

CVE-2026-82586 allows unauthorized attribute access in ash_lua, potentially impacting data confidentiality. Defenders should verify exposure, assess Lua script handling, and update vulnerable versions.

• Verify Lua script handling and attribute access controls
• Assess exposure in ash_lua versions from 0.1.0 before 0.2.1
• Update ash_lua to version 0.2.1 or later if vulnerable

Technical summary

The ash_lua component in ash-project is vulnerable to Improper Protection of Alternate Path, allowing unauthorized access to attributes not on the exposed-field allow-list. The vulnerability impacts data confidentiality, allowing unauthorized access to attributes not on the exposed-field allow-list. A script can therefore read the value of any attribute of any record the actor may read, including private sensitive?: true columns, via resource.read({ operation = {“list”, “hashed_password”} }); min and max give a value oracle. Anyone able to submit or influence a Lua script can reach this.

Defensive priority

Verify exposure in ash_lua versions from 0.1.0 before 0.2.1; assess Lua script handling and attribute access controls.

Recommended defensive actions

• Verify ash_lua version and Lua script handling
• Assess attribute access controls and exposed fields
• Review and update ash_lua to version 0.2.1 or later if vulnerable
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. Limited information on exploitation or victim impact is available. The vulnerability allows unauthorized attribute access in ash_lua, potentially impacting data confidentiality. Defenders should verify exposure, assess Lua script handling, and update vulnerable versions. The issue affects ash_lua: from 0.1.0 before 0.2.1. Anyone able to submit or influence a Lua script can reach this.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.