CVE-2026-75760: CWE-209 Generation of Error Message Containing Sensitive Information in ash-project ash_ai

The vulnerability arises from AshAi.Changes.Vectorize generating error messages that directly include the raw error term from the embedding provider call failure. This raw error term can contain sensitive data such as the request URL, response body, and Authorization header with the API key. These error messages are rendered back to the caller by AshJsonApi and AshGraphql without sanitization, leading to information disclosure. The flaw is triggered by oversized or malformed vectorized content. The fix involves logging the raw error internally and returning a generic error message to the user instead.

Sensitive information including provider request state and credentials (such as API keys in Authorization headers) can be disclosed to attackers through user-facing validation error messages. This could lead to unauthorized access or abuse of the embedding provider API. The vulnerability is exploitable remotely without user interaction and requires low attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix involves changing the error handling to log raw errors internally and return generic error messages to users. Until an official fix is available, avoid exposing detailed error messages from embedding provider failures in user-facing responses.