Read the docs
TI-2026-38583 Aliases CVE-2026-53509GHSA-g84h-j7jj-x32p

@aborruso/ckan-mcp-server: SSRF via base_url allows access to internal networks (Potential fix bypass of CVE-2026-33060)

Priority LOW 26CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-918 and the CVSS impact.

Summary

CKAN MCP Server is a tool for querying CKAN open data portals. A known vulnerability CVE-2026-33060 indicated tools including ckan_package_search and sparql_query that accept a base_url parameter had the risk of making HTTP requests to arbitrary endpoints without restriction. A fix was applied to filter out ip addresses. However, a method to bypass exists prior to version 0.4.106. CKAN MCP Server validates caller-supplied CKAN server URLs by inspecting only the parsed hostname string before issuing outbound HTTP requests. In `src/utils/http.ts`, hostname aliases such as `ip6-localhost` are not equal to `localhost`, are not dotted IPv4 literals, and are not bracketed IPv6 literals, so they pass the SSRF filter but can resolve to loopback when the server performs the request. A remote MCP caller that can invoke CKAN tools with a `server_url` can therefore make the server connect to local or private addresses and, for CKAN-shaped responses, receive response-derived data. The updated fix in version 0.4.106 replaced the single `hostname === 'localhost'` check with a blocked-hostname `Set` covering `ip6-localhost` and `ip6-loopback`.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00384 32nd percentileScored 2026-11-07
Fix Fixed ckan-mcp-server (ondata): 0.4.106@aborruso/ckan-mcp-server (npm): 0.4.106

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ondatackan-mcp-serverbefore 0.4.1060.4.106Patch availableCNA
—@aborruso/ckan-mcp-server (npm)before 0.4.1060.4.106Patch availableGHSA-g84h-j7jj-x32p
  • ckan-mcp-server Vendorondata Affected before 0.4.106 Fixed in 0.4.106 Patch available CNA
  • @aborruso/ckan-mcp-server (npm) Vendor— Affected before 0.4.106 Fixed in 0.4.106 Patch available GHSA-g84h-j7jj-x32p

Remediation

  • Fix · CNA ckan-mcp-server (ondata) Fixed in 0.4.106
  • Fix · GHSA-g84h-j7jj-x32p @aborruso/ckan-mcp-server (npm) Fixed in 0.4.106 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-53509
  2. 2026-10-03 Alias added: GHSA-g84h-j7jj-x32p

References

Advisory 1

Other 3

  • TI-2026-51869 CKAN MCP Server: Cache-key canonicalization collision enables cache confusion / poisoning CVSS 3.1MEDIUM 6.5
  • TI-2026-25502 CKAN MCP Server: SSRF via base_url allows access to internal networks CVSS 3.1MEDIUM 5.7
  • TI-2026-51867 CKAN MCP Server: Information disclosure via verbose error reflection CVSS 3.1LOW 3.7
  • TI-2026-51868 CKAN MCP Server: MQA server allowlist bypass via unanchored regex (`isValidMqaServer`) CVSS 3.1MEDIUM 5.3
  • TI-2026-44132 @aborruso/ckan-mcp-server has SSRF via DNS-name → internal IP — incomplete fix of CVE-2026-53509 CVSS 3.1MEDIUM 5.7
  • TI-2026-84568 Missing origin checks in CKAN MCP Server DataStore table UI CVSS 3.1LOW 3.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences