Is CVE-2026-82586 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-82586 being exploited in the wild.

How severe is CVE-2026-82586?

Informational severity, published 7 September 2026.

Which products and versions are affected?

Ash-Project Ash Lua 0.1.0 before 0.2.1.

Is there a fix for CVE-2026-82586?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-82586 attacked?

It is attacked over the network or with local access.

Am I affected by CVE-2026-82586?

Check whether you run Ash-Project Ash Lua at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82586: ash-project ash_lua authorization bypass in aggregation read

CVE-2026-82586 · Severity: info · Published 2026-09-07

AshLua is a library that exposes Ash resources (a data abstraction framework) to Lua scripts with access controls defined via an allow-list of exposed fields. An attacker with the ability to submit or modify Lua scripts can bypass these access controls to read sensitive attributes—including private columns marked as sensitive—that should not be accessible, potentially exposing password hashes, encryption keys, and other protected data.

Vendors: Ash-Project.

Quick answers

Is CVE-2026-82586 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-82586 being exploited in the wild.
How severe is CVE-2026-82586?: Informational severity, published 7 September 2026.
Which products and versions are affected?: Ash-Project Ash Lua 0.1.0 before 0.2.1.
Is there a fix for CVE-2026-82586?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-82586 attacked?: It is attacked over the network or with local access.
Am I affected by CVE-2026-82586?: Check whether you run Ash-Project Ash Lua at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an improper access control bypass in the aggregation path of AshLua.Runtime. When processing read operations with aggregation (min/max), the code accepts field names directly from Lua and converts them via String.to_existing_atom and Ash.Query.Aggregate.new! without validating against the exposed-field allow-list that is enforced for normal field reads. An attacker can call resource.read({ operation = {"list", "hashed_password"} }) or similar to extract any attribute, including sensitive columns. The vulnerability affects ash_lua from version 0.1.0 before 0.2.1, and exploitation requires the ability to submit or influence a Lua script passed to the runtime.

Affected products

ash-project ash_lua 0.1.0 before 0.2.1

Timeline

2026-09-07: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.