What happened
Part of the same 6-CVE ash_ai coordinated disclosure, this flaw allows a malicious webpage visited by a developer to bypass DNS-rebinding protections and drive the developer's local MCP server as if it were a trusted client.
Why it matters
Local MCP servers are increasingly used by AI coding agents; a browser-based DNS-rebinding bypass turns visiting a malicious website into a foothold for issuing privileged local agent actions.
Attack vector
With default allowed_origins: nil, origin_allowed?/1 in AshAi.Mcp.Server fails to properly validate Host/Origin headers, letting a malicious web page use DNS rebinding to bypass the MCP server's cross-origin protection and issue requests to a user's local MCP server acting with that user's authority.
Affected systems
ash-project ash_ai, MCP server component, default allowed_origins: nil
Mitigation
Upgrade to ash_ai 1.0.0+ and explicitly configure allowed_origins for local MCP servers.