CVE-2026-81315

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-81315
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-81315.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-81315
Aliases
Published
2026-08-31T00:57:55Z
Modified
2026-10-28T02:30:24Z
Severity
  • 7.4 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
MCP DNS-rebinding origin check in AshAi is bypassed by a spoofed X-Forwarded-Proto header
Details

Origin Validation Error vulnerability in ash-project ash_ai allows a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-site requests to a user's local MCP server with that user's actor.

In AshAi.Mcp.Server, with the default allowed_origins: nil, origin_allowed?/3 accepts an origin when uri.host == conn.host and the forwarded scheme is https. Both values are attacker-controlled: conn.host comes from the Host header and the scheme is read from the raw x-forwarded-proto header with no trusted-proxy check. Under DNS rebinding the browser sends the attacker's origin and a matching host, and page JavaScript may set X-Forwarded-Proto: https, so the check passes with no TLS or proxy involved. The fix trusts only localhost origins by default; other origins require an explicit allowed_origins allowlist.

This issue affects ash_ai: from 0.8.0 before 1.0.0.

Database specific 
{
    "cna_assigner":  "EEF",
    "cwe_ids":  [
        "CWE-346"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81315.json"
}
References

Affected packages

Git / github.com/ash-project/ash_ai

Affected ranges

Type
GIT
Repo
https://github.com/ash-project/ash_ai
Events
Introduced
c94f0b17fbe252f68755ba512678586164ba6139
Fixed
28af68d73134df0b8fb3aa6ab03e8fd795b07c21
Introduced
9dc782541629a80df5f13876b40c78ab882214a1
Fixed
f72b14744996e71df6d73480d617d963f340597b
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "c94f0b17fbe252f68755ba512678586164ba6139"
                },
                {
                    "fixed":  "28af68d73134df0b8fb3aa6ab03e8fd795b07c21"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "introduced":  "0.8.0"
                },
                {
                    "fixed":  "1.0.0"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "fixed":  "28af68d73134df0b8fb3aa6ab03e8fd795b07c21"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

v0.*
v0.8.0
v0.8.1
v0.8.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-81315.json"