In AshAi.Mcp.Server, with the default allowed_origins: nil, origin_allowed?/3 accepts an origin when uri.host == conn.host and the forwarded scheme is https. Both values are attacker-controlled: conn.host comes from the Host header and the scheme is read from the raw x-forwarded-proto header with no trusted-proxy check. Under DNS rebinding the browser sends the attacker's origin and a matching host, and page JavaScript may set X-Forwarded-Proto: https, so the check passes with no TLS or proxy involved. The fix trusts only localhost origins by default; other origins require an explicit allowed_origins allowlist.
This issue affects ash_ai: from 0.8.0 before 1.0.0.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| ash-project | ash_ai | unaffected |
|
||||||
| ash-project | ash_ai | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Mon, 31 Aug 2026 01:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Origin Validation Error vulnerability in ash-project ash_ai allows a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-site requests to a user's local MCP server with that user's actor. In AshAi.Mcp.Server, with the default allowed_origins: nil, origin_allowed?/3 accepts an origin when uri.host == conn.host and the forwarded scheme is https. Both values are attacker-controlled: conn.host comes from the Host header and the scheme is read from the raw x-forwarded-proto header with no trusted-proxy check. Under DNS rebinding the browser sends the attacker's origin and a matching host, and page JavaScript may set X-Forwarded-Proto: https, so the check passes with no TLS or proxy involved. The fix trusts only localhost origins by default; other origins require an explicit allowed_origins allowlist. This issue affects ash_ai: from 0.8.0 before 1.0.0. | |
| Title | MCP DNS-rebinding origin check in AshAi is bypassed by a spoofed X-Forwarded-Proto header | |
| First Time appeared |
Ash-project
Ash-project ash Ai |
|
| Weaknesses | CWE-346 | |
| CPEs | cpe:2.3:a:ash-project:ash_ai:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Ash-project
Ash-project ash Ai |
|
| References |
| |
| Metrics |
cvssV4_0
|
MITRE
Status: PUBLISHED
Assigner: EEF
Published:
Updated: 2026-08-31T00:57:55.910Z
Reserved: 2026-08-30T20:00:01.860Z
Link: CVE-2026-81315
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-08-31T01:16:49.977
Modified: 2026-08-31T01:16:49.977
Link: CVE-2026-81315
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-08-31T02:30:18Z
-
CWE-346
Origin Validation Error