Skip to content
Log inStart free trial

EEF-CVE-2026-81315 CVE-2026-81315 GHSA-c92r-f3rr-q49h

MCP DNS-rebinding origin check in AshAi is bypassed by a spoofed X-Forwarded-Proto header

Not rated yet Hex
Severity
0.0 / 10
Unknown · CVSS 4.0
Exploit chance (EPSS)
0.28%
Chance of exploitation in the next 30 days. Higher than 20.24% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-346 Origin Validation Error
Fix
1.0.0
Upgrade ash_ai to this version or later

Description

Summary

Origin Validation Error vulnerability in ash-project ash_ai allows a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-site requests to a user's local MCP server with that user's actor.

In AshAi.Mcp.Server, with the default allowed_origins: nil, origin_allowed?/3 accepts an origin when uri.host == conn.host and the forwarded scheme is https. Both values are attacker-controlled: conn.host comes from the Host header and the scheme is read from the raw x-forwarded-proto header with no trusted-proxy check. Under DNS rebinding the browser sends the attacker's origin and a matching host, and page JavaScript may set X-Forwarded-Proto: https, so the check passes with no TLS or proxy involved. The fix trusts only localhost origins by default; other origins require an explicit allowed_origins allowlist.

This issue affects ash_ai: from 0.8.0 before 1.0.0.

Affected versions

Hex

PackageVulnerableFixed in
ash_ai
>= 0.8.0, < 1.0.0
1.0.0

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

ash_ai Hex → 1.0.0

mix
{:ash_ai, "~> 1.0.0"} # then: mix deps.update ash_ai

Severity breakdown

CVSS 4.0 0.0

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Attack vector
Network
Attack complexity
Low
Attack requirements
Present
Privileges required
None
User interaction
Active
Confidentiality (vulnerable system)
High
Integrity (vulnerable system)
High
Availability (vulnerable system)
None
Confidentiality (subsequent systems)
None
Integrity (subsequent systems)
None
Availability (subsequent systems)
None

Weakness

CWE-346: Origin Validation Error

The product does not properly verify that the source of data or communication is valid.

References

Advisories

Fixes and patches

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
EEF-CVE-2026-78230
AshAi aggregate tool can read field-policy-protected fields
Not rated yet Also affects ash_ai
EEF-CVE-2026-75760
AshAi vectorize change leaks raw embedding-provider errors, including credentials, in a user-facing error
Not rated yet Also affects ash_ai
EEF-CVE-2026-82580
AshAi echoes raw tool exception messages into the conversation, disclosing internal details
Not rated yet Also affects ash_ai
EEF-CVE-2026-82579
AshAi tool loop never terminates when all tool calls are filtered out, enabling denial of service
Not rated yet Also affects ash_ai
EEF-CVE-2026-82564
Identity tool filter in AshAi accepts operator maps, allowing update or destroy of unidentified records
Not rated yet Also affects ash_ai
EEF-CVE-2026-77956
EEx template evaluation of prompt content in AshAi enables remote code execution
Not rated yet Also affects ash_ai
GHSA-997q-gvvc-jwmx
Electron: openExternal permission requests can be attributed to the wrong origin
Medium Same weakness, CWE-346
GHSA-fw47-9c62-h3vw
Electron: HID and USB permission checks can be attributed to the wrong origin
Medium Same weakness, CWE-346

Credits: Jonatan Männchen / EEF, Peter Ullrich, Zach Daniel / Ash Project

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor