CVE-2026-81315
Received Received - Intake

Origin Validation Error in AshAi MCP Server

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: EEF

Description
Origin Validation Error vulnerability in ash-project ash_ai allows a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-site requests to a user's local MCP server with that user's actor. In AshAi.Mcp.Server, with the default allowed_origins: nil, origin_allowed?/3 accepts an origin when uri.host == conn.host and the forwarded scheme is https. Both values are attacker-controlled: conn.host comes from the Host header and the scheme is read from the raw x-forwarded-proto header with no trusted-proxy check. Under DNS rebinding the browser sends the attacker's origin and a matching host, and page JavaScript may set X-Forwarded-Proto: https, so the check passes with no TLS or proxy involved. The fix trusts only localhost origins by default; other origins require an explicit allowed_origins allowlist. This issue affects ash_ai: from 0.8.0 before 1.0.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-81315
EUVD
EUVD-2026-68304

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ash-project ash_ai From 0.8.0 (inc) to 1.0.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-346 The product does not properly verify that the source of data or communication is valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Origin Validation Error in the ash-project's ash_ai library. It allows a malicious webpage to bypass DNS-rebinding protection in the MCP server by manipulating the Host header and X-Forwarded-Proto header. The server incorrectly trusts these headers, enabling cross-site requests to the user's local MCP server with the user's permissions. The default configuration is vulnerable, but the fix restricts origin validation to localhost only.

Detection Guidance

To detect this vulnerability, inspect network traffic for requests to your MCP server with spoofed Host or X-Forwarded-Proto headers. Check server logs for unusual origins or repeated failed origin validation attempts. Use tools like Wireshark or tcpdump to capture and analyze HTTP headers for suspicious patterns.

Impact Analysis

An attacker could exploit this to make unauthorized requests to your local MCP server, potentially accessing sensitive data or executing commands with your permissions. This could lead to data theft, system compromise, or further attacks on your local network. The attack requires you to visit a malicious webpage.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. It may result in data breaches, non-compliance with data protection obligations, and potential legal penalties due to compromised personal or health information.

Mitigation Strategies

Upgrade ash_ai to version 1.0.0 or later. If using an older version, set allowed_origins to explicitly allow only trusted origins. Disable reliance on Host and X-Forwarded-Proto headers for origin validation. Restrict server access to localhost by default and avoid exposing MCP servers to untrusted networks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81315. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart