CVE-2026-81315

Name of the Vulnerable Software and Affected Versions ash ai versions 0.8.0 through 0.9.x

Description An origin validation error in AshAi.Mcp.Server allows a malicious web page to bypass DNS-rebinding protection and issue cross-site requests to a user's local MCP server using that user's actor. When the allowed origins variable is set to nil, the origin allowed?/3 function accepts an origin if uri.host matches conn.host and the forwarded scheme is https. Because conn.host is derived from the Host header and the scheme is read from the x-forwarded-proto header without a trusted-proxy check, both values are attacker-controlled. In a DNS rebinding scenario, the browser sends the attacker's origin and a matching host, while JavaScript can set the X-Forwarded-Proto header to https, allowing the check to pass without TLS or a proxy.

Recommendations Update ash ai to version 1.0.0 or later.