Ash AI patched a spoofable MCP origin check and published the CVE the same night, five hours from reservation to record

The Erlang Ecosystem Foundation, acting as CVE numbering authority for the Elixir ecosystem, published CVE-2026-81315 on 2026-08-31 against ash_ai, the AI package of the Ash framework whose AshAi.Mcp.Server module serves MCP. With the default allowed_origins: nil, the module's DNS-rebinding protection reconstructed the expected origin using the X-Forwarded-Proto request header. A malicious web page could spoof that header, pass the origin check, and issue cross-site requests to a user's local MCP server with that user's actor. The record rates it 7.4 high on CVSS 4.0, affecting 0.8.0 up to the fix.

What distinguishes this disclosure is its clock. The CVE id was reserved at 20:00 UTC on 2026-08-30. The fix, which rejects spoofable Host and X-Forwarded-Proto values in the origin check, was committed at 22:21. v1.0.0 shipped at 23:24. The record went public at 00:57. Reservation to publication took just under five hours, with the fixed release out before the record existed; most MCP security records this year have trailed their fixes by weeks to months.

DNS-rebinding protection on locally bound MCP servers keeps producing records, from mcp-go's missing Host validation and the rest of the VulnCheck August batch to this bypass of a check that existed but trusted a forwarded header. The check is only as strong as the least trustworthy input it consults.