CVE-2026-81315

CVE-2026-81315 is an origin validation error (CWE-346) in the MCP server shipped with the Elixir package ash-project ash_ai, leaving it open to DNS-rebinding attacks. In AshAi.Mcp.Server, when the default allowed_origins: nil is in effect, origin_allowed?/3 accepts an origin if uri.host equals conn.host and the forwarded scheme is https, but both values are attacker-controlled because conn.host is taken from the Host header and the scheme is read from the raw x-forwarded-proto header with no trusted-proxy check. A malicious web page can therefore use DNS rebinding so the browser sends an attacker-matching Host, and its JavaScript can set X-Forwarded-Proto: https, passing the check with no TLS or proxy involved. The attacker gains the ability to issue cross-site requests to the victim's local MCP server with that user's actor, effectively acting as the authenticated user. Affected are deployments running the ash_ai MCP server in versions from 0.8.0 before 1.0.0; exploitation is not currently known (EPSS 0.2%, not in CISA KEV, no public PoC).

What to do: Upgrade ash_ai to 1.0.0 or later, which trusts only localhost origins by default and requires an explicit allowed_origins allowlist for any other origin. As interim mitigation, configure an explicit allowed_origins allowlist and only honor X-Forwarded-Proto from trusted proxies, and confirm whether your MCP server is reachable from a browser at all, since only browser-reachable deployments are meaningfully exposed.