EUVD-2026-68304Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H for DNS-rebinding timing requirement; UI:R for victim page visit; S:C because attack crosses from browser into local MCP server; no availability impact.
Primary rating from Vendor (EEF).
CVSS VectorVendor: EEF
Lifecycle Timeline
3DescriptionCVE.org
Origin Validation Error vulnerability in ash-project ash_ai allows a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-site requests to a user's local MCP server with that user's actor.
In AshAi.Mcp.Server, with the default allowed_origins: nil, origin_allowed?/3 accepts an origin when uri.host == conn.host and the forwarded scheme is https. Both values are attacker-controlled: conn.host comes from the Host header and the scheme is read from the raw x-forwarded-proto header with no trusted-proxy check. Under DNS rebinding the browser sends the attacker's origin and a matching host, and page JavaScript may set X-Forwarded-Proto: https, so the check passes with no TLS or proxy involved. The fix trusts only localhost origins by default; other origins require an explicit allowed_origins allowlist.
This issue affects ash_ai: from 0.8.0 before 1.0.0.
AnalysisAI
DNS-rebinding protection in AshAi.Mcp.Server (ash_ai 0.8.0-0.x) is bypassable because the default origin check trusts the attacker-controlled Host and X-Forwarded-Proto headers as proxies for TLS context. A malicious web page can exploit this to issue arbitrary cross-site requests to the victim's locally running MCP server, executing MCP calls under the victim's actor credentials. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) the victim is running ash_ai's AshAi.Mcp.Server with its default allowed_origins: nil setting (versions 0.8.0 to 0.x); (2) the victim visits an attacker-controlled web page in a browser; (3) the attacker controls a DNS record with a TTL short enough to expire and be re-resolved to 127.0.0.1 while the page remains open (classic DNS-rebinding prerequisite); (4) the MCP server is listening on a port reachable from localhost in the browser. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 7.4 (AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N) correctly reflects high confidentiality and integrity impact on the vulnerable system with no availability dimension. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade ash_ai to version 1.0.0 or later, which contains the fix committed at https://github.com/ash-project/ash_ai/commit/28af68d73134df0b8fb3aa6ab03e8fd795b07c21. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote code execution in ash_ai (versions 0.1.0 through pre-1.0.0) allows unauthenticated network attackers to execute a
Authorization bypass in AshAi (ash_ai) versions 0.6.0 through pre-1.0.0 allows any authenticated tool caller to update o
Credential leakage in ash_ai (versions 0.1.0 through before 1.0.0) exposes embedding provider API keys and request inter
Infinite-loop denial-of-service in ash_ai's ToolLoop component (versions 0.6.0 through <1.0.0) allows an attacker who ca
Field policy bypass in ash_ai (versions 0.1.0 through < 1.0.3) allows authenticated, low-privilege actors to read per-ac
Unfiltered exception serialization in ash_ai 0.6.0-0.x leaks internal application details - database schema, raw SQL fra
Same weakness CWE-346 – Origin Validation Error
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today