{"id":"CVE-2026-81315","aliases":["EEF-CVE-2026-81315","EUVD-2026-68304","GHSA-c92r-f3rr-q49h"],"status":"published","title":"MCP DNS-rebinding origin check in AshAi is bypassed by a spoofed X-Forwarded-Proto header","description":"Origin Validation Error vulnerability in ash-project ash_ai allows a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-site requests to a user's local MCP server with that user's actor.\n\nIn AshAi.Mcp.Server, with the default allowed_origins: nil, origin_allowed?/3 accepts an origin when uri.host == conn.host and the forwarded scheme is https. Both values are attacker-controlled: conn.host comes from the Host header and the scheme is read from the raw x-forwarded-proto header with no trusted-proxy check. Under DNS rebinding the browser sends the attacker's origin and a matching host, and page JavaScript may set X-Forwarded-Proto: https, so the check passes with no TLS or proxy involved. The fix trusts only localhost origins by default; other origins require an explicit allowed_origins allowlist.\n\nThis issue affects ash_ai: from 0.8.0 before 1.0.0.","severity":{"version":"4.0","score":7.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00278,"percentile":0.20456,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-346"],"published":"2026-08-31T00:57:55Z","modified":"2026-10-28T02:30:24Z","fixes":[{"ecosystem":"Hex","package":"ash_ai","fixed_in":["1.0.0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Hex","package":"ash_ai","ranges":[{"type":"SEMVER","events":[{"introduced":"0.8.0"},{"fixed":"1.0.0"}]}],"versions":["0.8.0","0.8.1","0.8.2"]}],"products":[{"vendor":"ash-project","product":"ash_ai"}],"references":[{"url":"https://github.com/ash-project/ash_ai/security/advisories/GHSA-c92r-f3rr-q49h","tags":["vendor-advisory","related","exploit","advisory"]},{"url":"https://cna.erlef.org/cves/CVE-2026-81315.html","tags":["related","web"]},{"url":"https://osv.dev/vulnerability/EEF-CVE-2026-81315","tags":["related","web"]},{"url":"https://github.com/ash-project/ash_ai/commit/28af68d73134df0b8fb3aa6ab03e8fd795b07c21","tags":["patch","fix"]},{"url":"https://github.com","tags":["web"]},{"url":"https://repo.hex.pm","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81315.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81315","tags":["advisory"]},{"url":"https://github.com/ash-project/ash_ai","tags":["package"]},{"url":"https://hex.pm/packages/ash_ai","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-81315","title":"MCP DNS-rebinding origin check in AshAi is bypassed by a spoofed X-Forwarded-Proto header","description":"Origin Validation Error vulnerability in ash-project ash_ai allows a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-site requests to a user's local MCP server with that user's actor.\n\nIn AshAi.Mcp.Server, with the default allowed_origins: nil, origin_allowed?/3 accepts an origin when uri.host == conn.host and the forwarded scheme is https. Both values are attacker-controlled: conn.host comes from the Host header and the scheme is read from the raw x-forwarded-proto header with no trusted-proxy check. Under DNS rebinding the browser sends the attacker's origin and a matching host, and page JavaScript may set X-Forwarded-Proto: https, so the check passes with no TLS or proxy involved. The fix trusts only localhost origins by default; other origins require an explicit allowed_origins allowlist.\n\nThis issue affects ash_ai: from 0.8.0 before 1.0.0.","status":"published","published":"2026-08-31T00:57:55.91Z","modified":"2026-08-31T16:02:38.7Z","cvss":[{"version":"4.0","score":7.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-346"],"updated_at":"2026-11-02T13:36:18.075535Z"}],"euvd":[{"id":"EUVD-2026-68304","description":"Origin Validation Error vulnerability in ash-project ash_ai allows a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-site requests to a user's local MCP server with that user's actor.\n\nIn AshAi.Mcp.Server, with the default allowed_origins: nil, origin_allowed?/3 accepts an origin when uri.host == conn.host and the forwarded scheme is https. Both values are attacker-controlled: conn.host comes from the Host header and the scheme is read from the raw x-forwarded-proto header with no trusted-proxy check. Under DNS rebinding the browser sends the attacker's origin and a matching host, and page JavaScript may set X-Forwarded-Proto: https, so the check passes with no TLS or proxy involved. The fix trusts only localhost origins by default; other origins require an explicit allowed_origins allowlist.\n\nThis issue affects ash_ai: from 0.8.0 before 1.0.0.","status":"published","published":"2026-08-31T00:57:55Z","modified":"2026-08-31T16:02:38Z","cvss":[{"version":"4.0","score":7.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T18:01:20.704822Z"}],"nvd":[{"id":"CVE-2026-81315","description":"Origin Validation Error vulnerability in ash-project ash_ai allows a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-site requests to a user's local MCP server with that user's actor.\n\nIn AshAi.Mcp.Server, with the default allowed_origins: nil, origin_allowed?/3 accepts an origin when uri.host == conn.host and the forwarded scheme is https. Both values are attacker-controlled: conn.host comes from the Host header and the scheme is read from the raw x-forwarded-proto header with no trusted-proxy check. Under DNS rebinding the browser sends the attacker's origin and a matching host, and page JavaScript may set X-Forwarded-Proto: https, so the check passes with no TLS or proxy involved. The fix trusts only localhost origins by default; other origins require an explicit allowed_origins allowlist.\n\nThis issue affects ash_ai: from 0.8.0 before 1.0.0.","status":"published","published":"2026-08-31T01:16:49.977Z","modified":"2026-09-01T21:15:00.147Z","cvss":[{"version":"4.0","score":7.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-346"],"updated_at":"2026-11-02T14:12:42.691315Z"}],"osv":[{"id":"CVE-2026-81315","title":"MCP DNS-rebinding origin check in AshAi is bypassed by a spoofed X-Forwarded-Proto header","description":"Origin Validation Error vulnerability in ash-project ash_ai allows a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-site requests to a user's local MCP server with that user's actor.\n\nIn AshAi.Mcp.Server, with the default allowed_origins: nil, origin_allowed?/3 accepts an origin when uri.host == conn.host and the forwarded scheme is https. Both values are attacker-controlled: conn.host comes from the Host header and the scheme is read from the raw x-forwarded-proto header with no trusted-proxy check. Under DNS rebinding the browser sends the attacker's origin and a matching host, and page JavaScript may set X-Forwarded-Proto: https, so the check passes with no TLS or proxy involved. The fix trusts only localhost origins by default; other origins require an explicit allowed_origins allowlist.\n\nThis issue affects ash_ai: from 0.8.0 before 1.0.0.","status":"published","published":"2026-08-31T00:57:55.91Z","modified":"2026-10-28T02:30:24.407694585Z","cvss":[{"version":"4.0","score":7.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-346"],"updated_at":"2026-11-02T15:45:18.131258Z"},{"id":"EEF-CVE-2026-81315","title":"MCP DNS-rebinding origin check in AshAi is bypassed by a spoofed X-Forwarded-Proto header","description":"## Summary\n\nOrigin Validation Error vulnerability in ash-project ash_ai allows a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-site requests to a user's local MCP server with that user's actor.\n\nIn `AshAi.Mcp.Server`, with the default `allowed_origins: nil`, `origin_allowed?/3` accepts an origin when `uri.host == conn.host` and the forwarded scheme is `https`. Both values are attacker-controlled: `conn.host` comes from the `Host` header and the scheme is read from the raw `x-forwarded-proto` header with no trusted-proxy check. Under DNS rebinding the browser sends the attacker's origin and a matching host, and page JavaScript may set `X-Forwarded-Proto: https`, so the check passes with no TLS or proxy involved. The fix trusts only localhost origins by default; other origins require an explicit `allowed_origins` allowlist.\n\nThis issue affects ash_ai: from 0.8.0 before 1.0.0.","status":"published","published":"2026-08-31T00:57:55.91Z","modified":"2026-09-08T02:15:03.732553667Z","cvss":[{"version":"4.0","score":7.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-346"],"updated_at":"2026-11-02T15:46:33.520522Z"}]}}