CVE-2026-81315: ash_ai DNS-Rebinding Origin Check Bypass Vulnerability
Summary
CVE-2026-81315: MCP DNS-rebinding origin check in AshAi is bypassed by a spoofed X-Forwarded-Proto header. Affects ash_ai across 2 version ranges.
>= 0.8.0, < 1.0.0
>= c94f0b17fbe252f68755ba512678586164ba6139, < 28af68d73134df0b8fb3aa6ab03e8fd795b07c21
Fixed in 1.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ash_ai is a package within the Ash framework designed for building APIs in Elixir. It provides functionalities for managing and processing requests in a structured manner. However, it has a critical vulnerability that allows attackers to bypass origin checks, potentially leading to unauthorized access to local servers.
Vulnerability Detail
The vulnerability arises from an origin validation error in the ash_ai package, specifically in the AshAi.Mcp.Server component. The issue allows a malicious web page to exploit the MCP server's DNS-rebinding protection by manipulating the X-Forwarded-Proto header. This manipulation enables cross-site requests to a user's local MCP server, using the user's actor, without proper validation. The attacker can control both the host and the scheme, leading to significant security risks, including unauthorized data access and potential system compromise.
How To Fix
Latest published version: 1.4.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.0.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can configure the allowed_origins setting in your application to only trust localhost origins. This can be done by setting allowed_origins to ['http://localhost', 'https://localhost'] in your configuration file, ensuring that only requests from these origins are accepted.
Conclusion
CVE-2026-81315 is a critical vulnerability in the ash_ai package that allows attackers to bypass origin checks, leading to potential unauthorized access to local servers. It is essential to update to the patched version or implement workarounds to protect your application from exploitation.
See every vulnerability recorded for ash_ai →
FAQ
CVE-2026-81315 is a vulnerability in the ash_ai package that allows attackers to bypass DNS-rebinding protections, enabling unauthorized access to local servers.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your application.
The vulnerability can lead to unauthorized access to sensitive data, manipulation of user sessions, and potential system compromise, posing serious security risks.
Yes, a patch is available in version 1.0.0 of the ash_ai package. It is recommended to update to this version to mitigate the vulnerability.
If immediate updates are not possible, implement the recommended workaround by restricting allowed origins to localhost until you can apply the patch.
Related vulnerabilities
Recent vulnerabilities recorded for ash_ai.
