{"answers":{"affected":"1 open source package ship an affected version, including ash_ai.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-81315 exists.","fix":"Upgrade ash_ai to 1.0.0 or later.","what":"CVE-2026-81315 is a high-severity vulnerability in ash-project ash_ai, published on 31 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for CVE-2026-81315 and fix it if it is affected.\n\nWhat it is: CVE-2026-81315 is a high-severity vulnerability in ash-project ash_ai, published on 31 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-81315 exists.\n\nAffected packages and fixed versions:\n- ash_ai (Hex): affected from 0.8.0; fixed in 1.0.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-81315/ (Markdown: https://insights.sbomify.com/CVE-2026-81315/index.md)","id":"CVE-2026-81315","markdown":"https://insights.sbomify.com/CVE-2026-81315/index.md","name":"CVE-2026-81315","record":{"aliases":["EEF-CVE-2026-81315","GHSA-c92r-f3rr-q49h"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["security_bypass","account_takeover"],"network_reachable":"yes","non_default_config":false,"product_category":"Elixir MCP server library","requires_auth":"none","summary":"Attackers can bypass DNS-rebinding protections in AshAi MCP servers by spoofing headers, enabling cross-site requests to local servers.","user_interaction":"required","vuln_class":"security_feature_bypass"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"EEF","cpe":[],"cvss":{"score":7.4,"severity":"high","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-346","name":"Origin Validation Error"}],"description":"Origin Validation Error vulnerability in ash-project ash_ai allows a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-site requests to a user's local MCP server with that user's actor.\n\nIn AshAi.Mcp.Server, with the default allowed_origins: nil, origin_allowed?/3 accepts an origin when uri.host == conn.host and the forwarded scheme is https. Both values are attacker-controlled: conn.host comes from the Host header and the scheme is read from the raw x-forwarded-proto header with no trusted-proxy check. Under DNS rebinding the browser sends the attacker's origin and a matching host, and page JavaScript may set X-Forwarded-Proto: https, so the check passes with no TLS or proxy involved. The fix trusts only localhost origins by default; other origins require an explicit allowed_origins allowlist.\n\nThis issue affects ash_ai: from 0.8.0 before 1.0.0.","ecosystems":["Hex"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":true,"headline":"MCP DNS-rebinding origin check in AshAi is bypassed by a spoofed X-Forwarded-Proto header","id":"CVE-2026-81315","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Hex","product":null,"products":[],"type":"security_feature_bypass","year":"2026"},"n_packages":1,"n_references":4,"next":{"headline":"Same-named aggregates with differing filters are conflated in AshSql","id":"CVE-2026-81316"},"packages":[{"ecosystem":"Hex","fixed":["1.0.0"],"introduced":["0.8.0"],"last_affected":[],"package":"ash_ai","purl":"pkg:hex/ash_ai","source":"EEF-CVE-2026-81315"}],"prev":{"headline":"Image Scanner Driver for Linux contains a link following vulnerability.","id":"CVE-2026-81310"},"products":["ash_ai"],"published":"2026-08-31","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"Erlang Ecosystem Foundation","prefix":"EEF"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"poc","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-08-31","vendors":["ash-project"]},"summary":"Attackers can bypass DNS-rebinding protections in AshAi MCP servers by spoofing headers, enabling cross-site requests to local servers.","url":"https://insights.sbomify.com/CVE-2026-81315/"}