Origin Validation Error in AshAi MCP Server Affects Ash Project

CVE-2026-81315

What is CVE-2026-81315?

The vulnerability in the AshAi MCP Server allows a malicious web page to exploit an origin validation flaw, enabling DNS rebinding attacks. When the default setting permits nil origins, an attacker can craft a request that bypasses origin verification by manipulating the Host header and the X-Forwarded-Proto header. This serious flaw could allow unauthorized cross-site requests to the user's local MCP server, impacting data integrity and user security. To mitigate the risk, the latest patch restricts allowed origins to localhost by default and mandates explicit allowlisting for additional origins.

References