Read the docs
TI-2026-84568 Aliases CVE-2026-76894

Missing origin checks in CKAN MCP Server DataStore table UI

Priority LOW 15CWE-345Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-345.

Summary

CKAN MCP Server before 0.4.112 has a DataStore table UI resource that accepts window message events without checking event.origin. The same resource sends JSON-RPC messages with a wildcard target origin, so a frame that can reach the embedded document can inject fabricated fields or records, spoof pending ui/initialize responses, or receive outbound messages when embedded by an untrusted parent. Missing origin verification (CWE-345) lets an attacker in a reachable frame send messages the UI accepts as genuine. Exploitation requires user interaction and depends on how the host embeds the resource, and the injected content is display spoofing because values are HTML escaped.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Description from the CNA

CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, the DataStore table UI in src/resources/datastore-table-ui.ts accepts window message events without validating event.origin and sends JSON-RPC messages through postMessage with a wildcard target origin. A frame that can reach the embedded document can inject fabricated fields or records, spoof pending ui/initialize responses, disrupt the MCP UI handshake, or receive outbound messages when the resource is embedded by an untrusted parent. Values are HTML escaped, so the demonstrated content injection is display spoofing rather than script execution, and exploitability depends on the host embedding model. This issue is fixed in version 0.4.112.

Why it matters now

EPSS 0.00196 9th percentileScored 2026-11-07
Fix Fixed ckan-mcp-server (ondata): 0.4.112@aborruso/ckan-mcp-server (npm): 0.4.112

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ondatackan-mcp-serverbefore 0.4.1120.4.112Patch availableCNA
—@aborruso/ckan-mcp-server (npm)before 0.4.1120.4.112Patch availableGHSA-vqff-r82h-9crc
  • ckan-mcp-server Vendorondata Affected before 0.4.112 Fixed in 0.4.112 Patch available CNA
  • @aborruso/ckan-mcp-server (npm) Vendor— Affected before 0.4.112 Fixed in 0.4.112 Patch available GHSA-vqff-r82h-9crc

Remediation

Upgrade ckan-mcp-server and the npm package @aborruso/ckan-mcp-server to version 0.4.112, which fixes the issue. CISA does not list this vulnerability in its Known Exploited Vulnerabilities catalog.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

  • Fix · CNA ckan-mcp-server (ondata) Fixed in 0.4.112
  • Fix · GHSA-vqff-r82h-9crc @aborruso/ckan-mcp-server (npm) Fixed in 0.4.112 Advisory →

Timeline

  1. 2026-11-03 Threatist record created from CVE-2026-76894

References

Other 4

  • TI-2026-51869 CKAN MCP Server: Cache-key canonicalization collision enables cache confusion / poisoning CVSS 3.1MEDIUM 6.5
  • TI-2026-25502 CKAN MCP Server: SSRF via base_url allows access to internal networks CVSS 3.1MEDIUM 5.7
  • TI-2026-51867 CKAN MCP Server: Information disclosure via verbose error reflection CVSS 3.1LOW 3.7
  • TI-2026-51868 CKAN MCP Server: MQA server allowlist bypass via unanchored regex (`isValidMqaServer`) CVSS 3.1MEDIUM 5.3
  • TI-2026-44132 @aborruso/ckan-mcp-server has SSRF via DNS-name → internal IP — incomplete fix of CVE-2026-53509 CVSS 3.1MEDIUM 5.7
  • TI-2026-38583 @aborruso/ckan-mcp-server: SSRF via base_url allows access to internal networks (Potential fix bypass of CVE-2026-33060) CVSS 3.1MEDIUM 5.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences