AIKIDO-2026-98021
ash_ai is vulnerable to Cross-Site Request Forgery (CSRF)
74
High Risk
This Affects:
ash_aiTL;DR
AshAi.Mcp.Server validates request origin by comparing the Origin host and scheme against the connection, but it trusts the client-supplied X-Forwarded-Proto header when deciding the scheme. Because that header is not verified to come from a trusted proxy, a browser-driven request can set it to https and satisfy the origin check. This defeats the DNS-rebinding protection and lets a malicious web page drive requests against a local MCP server. The fix rejects spoofable Host and X-Forwarded-Proto values during the origin check.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you run the AshAi MCP HTTP server reachable from browsers or untrusted networks.
Background info
ash_ai is vulnerable to Cross-Site Request Forgery (CSRF) in versions 0.8.0 - 0.8.2.
How to fix this
Upgrade the ash_ai library to the patch version.
Links
GitHub Release
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.