CVE-2026-81315: CWE-346 Origin Validation Error in ash-project ash_ai

The vulnerability in ash_ai (CVE-2026-81315) is due to improper origin validation in AshAi.Mcp.Server. When allowed_origins is nil (default), the origin_allowed?/3 function accepts an origin if the URI host matches the connection host and the forwarded scheme is 'https'. Both values are attacker-controlled: the Host header controls conn.host, and the X-Forwarded-Proto header controls the scheme, with no trusted-proxy verification. Under DNS rebinding attacks, an attacker can craft a malicious web page that sets these headers to bypass the server's DNS-rebinding protections and issue cross-site requests to the local MCP server with the user's actor privileges. The vulnerability affects ash_ai versions >=0.8.0 and <1.0.0. The recommended fix is to trust only localhost origins by default and require an explicit allowed_origins allowlist for other origins.

An attacker can bypass DNS-rebinding protections and issue cross-site requests to a user's local MCP server with the user's actor privileges. This could lead to unauthorized actions being performed on the local MCP server on behalf of the user. The vulnerability requires user interaction (UI:A) and partial attack complexity (AC:L), with high impact on confidentiality and integrity (VC:H, VI:H).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix involves configuring the server to trust only localhost origins by default and requiring an explicit allowed_origins allowlist for other origins. Until an official patch or update is released, administrators should review and restrict allowed_origins settings to prevent accepting untrusted origins. No official fix or patch link is currently provided.