# CVE-2026-81315: MCP DNS-rebinding origin check in AshAi is bypassed by a spoofed X-Forwarded-Proto header

> Attackers can bypass DNS-rebinding protections in AshAi MCP servers by spoofing headers, enabling cross-site requests to local servers.

- **Severity:** High 7.4 (`CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N`)
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** A user has to click or open something
- **Fix available:** Yes
- **Published:** 31 Aug 2026
- **Updated:** 31 Aug 2026
- **Also known as:** EEF-CVE-2026-81315, GHSA-c92r-f3rr-q49h

## What is CVE-2026-81315?

CVE-2026-81315 is a high-severity vulnerability in ash-project ash_ai, published on 31 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

### Official description

Origin Validation Error vulnerability in ash-project ash_ai allows a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-site requests to a user's local MCP server with that user's actor.

In AshAi.Mcp.Server, with the default allowed_origins: nil, origin_allowed?/3 accepts an origin when uri.host == conn.host and the forwarded scheme is https. Both values are attacker-controlled: conn.host comes from the Host header and the scheme is read from the raw x-forwarded-proto header with no trusted-proxy check. Under DNS rebinding the browser sends the attacker's origin and a matching host, and page JavaScript may set X-Forwarded-Proto: https, so the check passes with no TLS or proxy involved. The fix trusts only localhost origins by default; other origins require an explicit allowed_origins allowlist.

This issue affects ash_ai: from 0.8.0 before 1.0.0.

Weakness: CWE-346 (Origin Validation Error)

## Which versions are affected by CVE-2026-81315?

1 open source package ship an affected version, including ash_ai.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `ash_ai` | Hex | From 0.8.0 | 1.0.0 |

## How do I fix CVE-2026-81315?

Upgrade ash_ai to 1.0.0 or later.

## Is CVE-2026-81315 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-81315 exists.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-81315 and fix it if it is affected.

What it is: CVE-2026-81315 is a high-severity vulnerability in ash-project ash_ai, published on 31 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Exploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-81315 exists.

Affected packages and fixed versions:
- ash_ai (Hex): affected from 0.8.0; fixed in 1.0.0

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-81315/ (Markdown: https://insights.sbomify.com/CVE-2026-81315/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-81315
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-81315
- OSV: https://osv.dev/vulnerability/CVE-2026-81315

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-81315/
Summaries are generated and may contain mistakes; the official description above is the record.