CVE-2026-81315
HighCVSS 7.4Summary
An Origin Validation Error vulnerability in ash-project ash_ai allows a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-site requests to a user's local MCP server with that user's actor. With default allowed_origins: nil, origin_allowed?/3 accepts an origin when uri.host == conn.host and the forwarded scheme is https, both attacker-controlled. The issue affects ash_ai from 0.8.0 before 1.0.0.
Risk Assessment
An attacker can take control of the user's local MCP server, performing actions on their behalf, potentially leading to unauthorized access to data or services.
Recommendation
Update ash_ai to version 1.0.0 or later, which by default trusts only localhost origins and requires an explicit allowlist for other origins.
Other vulnerabilities in ash_ai
See all- CVE-2026-82580Medium
In ash_ai (from 0.6.0 before 1.0.0), a vulnerability allows disclosure of sensitive information in error messages. Exceptions during tool execution are sent to chat users without filtering, potentially revealing internal technical details.
- CVE-2026-82579Medium
In ash_ai (from 0.6.0 before 1.0.0), a vulnerability allows an infinite loop. An attacker who can influence model outputs can hang the tool loop and cause unbounded, repeated model requests.
- CVE-2026-82564High
An authorization bypass through user-controlled key vulnerability in ash_ai allows a caller to update or destroy records it never identified, including every row in the table. The identity filter is built directly from raw tool arguments.
- CVE-2026-75760High
A vulnerability in ash_ai discloses provider request state and credentials in a user-facing validation error. When the embedding provider call fails, the error contains the raw error term, which may include the URL, response body, and Authorization header with the API key.
- CVE-2026-77956Critical
A code injection vulnerability in ash-project ash_ai allows a remote, unauthenticated client to execute arbitrary Elixir code. AshAi.Actions.Prompt evaluates prompt content through EEx.eval_string/2, and when prompt content incorporates request data, attacker-controlled text is compiled and run as an EEx template. This affects ash_ai from 0.1.0 before 1.0.0.
Original NVD description (English source)
Origin Validation Error vulnerability in ash-project ash_ai allows a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-site requests to a user's local MCP server with that user's actor. In AshAi.Mcp.Server, with the default allowed_origins: nil, origin_allowed?/3 accepts an origin when uri.host == conn.host and the forwarded scheme is https. Both values are attacker-controlled: conn.host comes from the Host header and the scheme is read from the raw x-forwarded-proto header with no trusted-proxy check. Under DNS rebinding the browser sends the attacker's origin and a matching host, and page JavaScript may set X-Forwarded-Proto: https, so the check passes with no TLS or proxy involved. The fix trusts only localhost origins by default; other origins require an explicit allowed_origins allowlist. This issue affects ash_ai: from 0.8.0 before 1.0.0.