62 matches found
CVE-2026-61612
creationtimestamp| type| source ---|---|--- 2026-09-22 15:32:08+00:00| seen| https://gist.github.com/alon710/3ba8e1fcc936f8ea3f0b915b4e9e571b 2026-09-22 16:35:02+00:00| published-proof-of-concept| https://github.com/ondata/ckan-mcp-server/security/advisories/GHSA-798p-78g2-v556...
@aborruso/ckan-mcp-server has SSRF via DNS-name → internal IP — incomplete fix of CVE-2026-53509
Summary The SSRF guard validateServerUrl added for CVE-2026-33060, extended for CVE-2026-53509 validates only the hostname string and never resolves DNS. Any caller-supplied serverurl whose hostname resolves to an internal address passes the guard, so the server issues requests to loopback and...
EUVD-2026-84031
@aborruso/ckan-mcp-server has SSRF via DNS-name → internal IP — incomplete fix of CVE-2026-53509...
GHSA-798P-78G2-V556 @aborruso/ckan-mcp-server has SSRF via DNS-name → internal IP — incomplete fix of CVE-2026-53509
Summary The SSRF guard validateServerUrl added for CVE-2026-33060, extended for CVE-2026-53509 validates only the hostname string and never resolves DNS. Any caller-supplied serverurl whose hostname resolves to an internal address passes the guard, so the server issues requests to loopback and...
@aborruso/ckan-mcp-server has SSRF via DNS-name → internal IP — incomplete fix of CVE-2026-53509
The SSRF guard validateServerUrl added for CVE-2026-33060, extended for CVE-2026-53509 validates only the hostname string and never resolves DNS. Any caller-supplied serverurl whose hostname resolves to an internal address passes the guard, so the server issues requests to loopback and cloud...
CVE-2026-61612
CKAN MCP Server is a tool for querying CKAN open data portals. Prior to version 0.4.108, the SSRF guard validateServerUrl added for CVE-2026-33060, extended for CVE-2026-53509 validates only the hostname string and never resolves DNS. Any caller-supplied serverurl whose hostname resolves to an...
CVE-2026-61612 @aborruso/ckan-mcp-server has SSRF via DNS-name → internal IP — incomplete fix of CVE-2026-53509
CKAN MCP Server is a tool for querying CKAN open data portals. Prior to version 0.4.108, the SSRF guard validateServerUrl added for CVE-2026-33060, extended for CVE-2026-53509 validates only the hostname string and never resolves DNS. Any caller-supplied serverurl whose hostname resolves to an...
CVE-2026-61612
The @aborruso/ckan-mcp-server (npm) component is vulnerable to Server-Side Request Forgery (SSRF) prior to version 0.4.108 . The root cause is a flaw in the validateServerUrl function within src/utils/http.ts, which validates only the hostname string without performing DNS resolution. This allows...
CVE-2026-61612 @aborruso/ckan-mcp-server has SSRF via DNS-name → internal IP — incomplete fix of CVE-2026-53509
CKAN MCP Server is a tool for querying CKAN open data portals. Prior to version 0.4.108, the SSRF guard validateServerUrl added for CVE-2026-33060, extended for CVE-2026-53509 validates only the hostname string and never resolves DNS. Any caller-supplied serverurl whose hostname resolves to an...
CVE-2026-73844
creationtimestamp| type| source ---|---|--- 2026-09-03 16:35:05+00:00| published-proof-of-concept| https://github.com/ondata/ckan-mcp-server/security/advisories/GHSA-6f9w-9hf2-5rg3...
CVE-2026-73846
creationtimestamp| type| source ---|---|--- 2026-09-03 16:35:02+00:00| published-proof-of-concept| https://github.com/ondata/ckan-mcp-server/security/advisories/GHSA-78x9-fhhx-v2g6 2026-09-03 17:31:38+00:00| seen| https://gist.github.com/alon710/6e5cd16daf1e1da3bc33cf6d0ea63990...
CKAN MCP Server: Cache-key canonicalization collision enables cache confusion / poisoning
Summary The response cache derives its key from an ambiguous string serialization of the request parameters. canonicalizeParams joins sorted $key=$value pairs with & and does not escape &, =, or the | field separators used in buildCacheKey. Two different logical parameter sets can therefore...
GHSA-78X9-FHHX-V2G6 CKAN MCP Server: Cache-key canonicalization collision enables cache confusion / poisoning
Summary The response cache derives its key from an ambiguous string serialization of the request parameters. canonicalizeParams joins sorted $key=$value pairs with & and does not escape &, =, or the | field separators used in buildCacheKey. Two different logical parameter sets can therefore...
EUVD-2026-58728
CKAN MCP Server: Cache-key canonicalization collision enables cache confusion / poisoning...
EUVD-2026-58724
CKAN MCP Server: Information disclosure via verbose error reflection...
GHSA-6F9W-9HF2-5RG3 CKAN MCP Server: Information disclosure via verbose error reflection
Summary Error paths reflect raw upstream response bodies and internal exception messages back to the caller instead of a sanitized, generic message. When the server is pointed at or redirected/SSRF'd to a host that returns a non-CKAN response, or when an internal exception occurs, the caller...
CKAN MCP Server: Information disclosure via verbose error reflection
Summary Error paths reflect raw upstream response bodies and internal exception messages back to the caller instead of a sanitized, generic message. When the server is pointed at or redirected/SSRF'd to a host that returns a non-CKAN response, or when an internal exception occurs, the caller...
CKAN MCP Server: Cache-key canonicalization collision enables cache confusion / poisoning
The response cache derives its key from an ambiguous string serialization of the request parameters. canonicalizeParams joins sorted $key=$value pairs with & and does not escape &, =, or the | field separators used in buildCacheKey. Two different logical parameter sets can therefore serialize to...
CKAN MCP Server: Information disclosure via verbose error reflection
Error paths reflect raw upstream response bodies and internal exception messages back to the caller instead of a sanitized, generic message. When the server is pointed at or redirected/SSRF'd to a host that returns a non-CKAN response, or when an internal exception occurs, the caller receives...