On August 30, 2026, maintainer zachdaniel disclosed a cluster of six vulnerabilities affecting ash_ai, an LLM toolbox extension for the Elixir-based Ash Framework. This release marks the first coordinated security disclosure within the Elixir/Ash ecosystem. The vulnerabilities, which span the entire agent stack—from prompt evaluation and tool execution to embedding pipelines and orchestration—were all addressed in version 1.0.0.
The most critical issue, CVE-2026-77956 (CVSS 8.9), is a remote code execution vulnerability in AshAi.Actions.Prompt. The framework is designed to treat user-provided prompt content as executable code via EEx.eval_string/2. Because this occurs before any model request, an unauthenticated attacker can execute arbitrary Elixir code by supplying malicious form content. This is an architectural design choice rather than a traditional injection bug, highlighting the risks inherent in frameworks that prioritize template-based flexibility over strict input isolation.
The cluster also includes CVE-2026-81315 (CVSS 7.4), an origin validation error in the Model Context Protocol server implementation. By manipulating the Host header and the X-Forwarded-Proto header, an attacker can bypass origin checks, allowing a malicious web page to issue cross-site requests to a user’s local MCP server. This mirrors the DNS-rebinding vulnerability class previously observed in Paperclip and other MCP implementations, confirming that the Elixir/BEAM ecosystem is subject to the same architectural weaknesses as other language stacks.
A novel attack vector emerged in CVE-2026-82564 (CVSS 7.1), which allows for authorization bypass. The vulnerability exists in AshAi.Tool.Execution, where nested JSON operands are parsed as predicate expressions. Because the filter-building code passes raw client JSON directly to Ash.Query.do_filter/2, an unauthenticated MCP caller can retarget updates or destroys to arbitrary records. This specific flaw demonstrates how identity-based tool execution models can be subverted when input validation fails to account for nested data structures.
The remaining vulnerabilities include CVE-2026-75760 (CVSS 7.1), which leaks API keys and provider URLs through raw error messages; CVE-2026-82579 (CVSS 6.0), an infinite loop in the tool orchestration logic; and CVE-2026-82580 (CVSS 5.3), which discloses database schema information via exception messages. These issues illustrate the agent amplification effect, where minor implementation errors in error handling or loop logic can be weaponized to extract sensitive system metadata.
Notably, all six CVEs were discovered by researcher PJUllrich using LLM-assisted security research—an agent-native signal of AI tools identifying vulnerabilities within the frameworks designed to build them. This trend reinforces the ongoing MCP wave that has seen high-severity disclosures across various platforms, including Splunk, HashiCorp, and ServiceNow.
The breadth of this cluster—covering RCE, DNS rebinding, auth bypass, credential leakage, and DoS—underscores the complexity of securing agentic toolboxes. As these extensions continue to integrate deeper into application frameworks, the surface area for exploitation grows, necessitating more rigorous validation of how frameworks handle user-controlled input and internal tool orchestration.