ash_ai CVE-2026-81315

Exploitation requires all of the following: (1) the victim is running ash_ai's AshAi.Mcp.Server with its default allowed_origins: nil setting (versions 0.8.0 to 0.x); (2) the victim visits an attacker-controlled web page in a browser; (3) the attacker controls a DNS record with a TTL short enough to expire and be re-resolved to 127.0.0.1 while the page remains open (classic DNS-rebinding prerequisite); (4) the MCP server is listening on a port reachable from localhost in the browser. Exploitation is blocked when: the MCP server is configured with an explicit :allowed_origins allowlist (which replaces the vulnerable code path); the server is listening on a non-standard port that the browser's port-blocking heuristics reject; or the victim's network enforces DNS-rebinding protections (some routers and enterprise DNS resolvers block external domains resolving to RFC-1918 addresses). No special authentication or privileges are needed by the attacker beyond the ability to serve a webpage and control a DNS record.

The CVSS 4.0 score of 7.4 (AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N) correctly reflects high confidentiality and integrity impact on the vulnerable system with no availability dimension. AT:P acknowledges the DNS-rebinding timing prerequisite, and UI:A correctly captures the requirement that the victim actively visit the attacker's page. No EPSS data was provided, and no KEV listing or public POC exists at time of analysis, so exploitation likelihood is inferred from the CVSS vector and technical mechanics rather than observed threat activity. The realistic risk is most relevant to developers who run ash_ai's MCP server during local development while also browsing the web - a plausible dual-use scenario in a development workflow. Enterprise or production deployments of the MCP server are less likely to be exposed to browser-sourced DNS-rebinding because they would typically sit behind a reverse proxy rather than directly on localhost. The absent availability impact, required user interaction, and DNS-rebinding timing constraint together limit mass exploitation; however, for targeted attacks against developers with sensitive local data exposed via MCP, the impact is significant.

A developer running ash_ai's local MCP server visits a malicious web page registered on attacker.example under a short DNS TTL. After the page loads, the attacker flips the DNS record to 127.0.0.1; the browser's same-origin policy now permits JavaScript on attacker.example to send fetch requests to the locally running MCP server on that domain. The malicious script includes the headers Host: attacker.example and X-Forwarded-Proto: https, causing the flawed origin_allowed?/3 check to pass, and issues arbitrary MCP tool calls under the victim's local actor credentials.