DNS rebinding flaw exposes ash_ai's local MCP server

A DNS rebind lets a malicious web page reach ash_ai's local MCP server as its logged-in user. NVD's advisory for CVE-2026-81315, published August 31 at severity 7.4, lays out the mechanism. The default config leaves every install exposed until someone sets allowed_origins by hand. An MCP server typically holds enough access to act on a user's behalf for real work.

The origin check, origin_allowed?/3, only matters because allowed_origins defaults to nil. It approves a request when the URI host matches conn.host and the forwarded scheme reads https. Both values come from headers a client controls. conn.host reads the Host header, and the scheme comes from raw x-forwarded-proto, with no check for a trusted proxy sitting in front of the server. A page loaded in a browser can rebind its DNS to point at the target machine, then forge both headers to pass the check.

Once past that check, the requests run as that user, with no extra check in between. Whatever the server can do on that user's behalf, the page can do too.

The fix is one line, set allowed_origins to an explicit list instead of leaving it nil. Anyone who wrote origin validation for their own MCP server should look at the same trap. The values it trusts need to come from something a client can't rewrite, not from conn.host or an unchecked forwarded-proto header.