CVE-2026-73846

creationtimestamp| type| source ---|---|--- 2026-09-03 16:35:02+00:00| published-proof-of-concept| https://github.com/ondata/ckan-mcp-server/security/advisories/GHSA-78x9-fhhx-v2g6 2026-09-03 17:31:38+00:00| seen| https://gist.github.com/alon710/6e5cd16daf1e1da3bc33cf6d0ea63990...

GHSA-78X9-FHHX-V2G6 CKAN MCP Server: Cache-key canonicalization collision enables cache confusion / poisoning

Summary The response cache derives its key from an ambiguous string serialization of the request parameters. canonicalizeParams joins sorted $key=$value pairs with & and does not escape &, =, or the | field separators used in buildCacheKey. Two different logical parameter sets can therefore...

CKAN MCP Server: Cache-key canonicalization collision enables cache confusion / poisoning

Summary The response cache derives its key from an ambiguous string serialization of the request parameters. canonicalizeParams joins sorted $key=$value pairs with & and does not escape &, =, or the | field separators used in buildCacheKey. Two different logical parameter sets can therefore...

EUVD-2026-58728

CKAN MCP Server: Cache-key canonicalization collision enables cache confusion / poisoning...

GHSA-6F9W-9HF2-5RG3 CKAN MCP Server: Information disclosure via verbose error reflection

Summary Error paths reflect raw upstream response bodies and internal exception messages back to the caller instead of a sanitized, generic message. When the server is pointed at or redirected/SSRF'd to a host that returns a non-CKAN response, or when an internal exception occurs, the caller...

CKAN MCP Server: Information disclosure via verbose error reflection

Summary Error paths reflect raw upstream response bodies and internal exception messages back to the caller instead of a sanitized, generic message. When the server is pointed at or redirected/SSRF'd to a host that returns a non-CKAN response, or when an internal exception occurs, the caller...

EUVD-2026-58724

CKAN MCP Server: Information disclosure via verbose error reflection...

ms-365-mcp-server-PoC

ms-365-mcp-server: security advisory CVE status: reques...

CKAN MCP Server: Information disclosure via verbose error reflection

Error paths reflect raw upstream response bodies and internal exception messages back to the caller instead of a sanitized, generic message. When the server is pointed at or redirected/SSRF'd to a host that returns a non-CKAN response, or when an internal exception occurs, the caller receives...

CKAN MCP Server: Cache-key canonicalization collision enables cache confusion / poisoning

The response cache derives its key from an ambiguous string serialization of the request parameters. canonicalizeParams joins sorted $key=$value pairs with & and does not escape &, =, or the | field separators used in buildCacheKey. Two different logical parameter sets can therefore serialize to...

EUVD-2026-64016

Omnigent: Shared Agent Bundle Overwrite Leads to Authenticated Runner RCE...

GHSA-JRRM-9HC7-2V3H Omnigent: Shared Agent Bundle Overwrite Leads to Authenticated Runner RCE

Summary An authenticated user with edit access to their own session can overwrite a shared/template agent by uploading a full agent bundle through PUT /sessions/sessionid/agent. Shared/template agents are shown as not MCP-editable, but this upload path still accepts a replacement bundle. By addin...

Omnigent: Shared Agent Bundle Overwrite Leads to Authenticated Runner RCE

Summary An authenticated user with edit access to their own session can overwrite a shared/template agent by uploading a full agent bundle through PUT /sessions/sessionid/agent. Shared/template agents are shown as not MCP-editable, but this upload path still accepts a replacement bundle. By addin...

CVE-2026-73845

creationtimestamp| type| source ---|---|--- 2026-09-02 16:35:22+00:00| published-proof-of-concept| https://github.com/ondata/ckan-mcp-server/security/advisories/GHSA-83x6-42hr-jc76...

@diviops/mcp-server (>=1.5.40, <=1.5.43), @donadiosolutions/lcm (>=1.4.2, <=1.4.3) +17 more potentially affected by CVE-2026-75931 via fast-uri (>=3.1.3, <=3.1.5)

fast-uri NPM version =3.1.3, =1.5.40, =1.4.2, =1.2.0, =0.2.0-alpha.5, =0.1.0, =0.1.6, =0.1.5, =3.38.11, =0.1.0, =0.1.2 and more Source cves: CVE-2026-75931 Source advisory: OSV:GHSA-5JGF-P345-68V8...

EUVD-2026-58725

CKAN MCP Server: MQA server allowlist bypass via unanchored regex isValidMqaServer...

CKAN MCP Server: MQA server allowlist bypass via unanchored regex (`isValidMqaServer`)

Summary The ckangetmqaquality and ckangetmqaqualitydetails tools restrict their serverurl argument to dati.gov.it via a regular expression. The regex is anchored only at the start and places no boundary after the host, so any URL whose host merely begins with dati.gov.it — or that uses dati.gov.i...

GHSA-83X6-42HR-JC76 CKAN MCP Server: MQA server allowlist bypass via unanchored regex (`isValidMqaServer`)

Summary The ckangetmqaquality and ckangetmqaqualitydetails tools restrict their serverurl argument to dati.gov.it via a regular expression. The regex is anchored only at the start and places no boundary after the host, so any URL whose host merely begins with dati.gov.it — or that uses dati.gov.i...

Malicious code in amazon-vendor-analytics-mcp-server (npm)

The package communicates with a domain associated with malicious activity. --- Credit: OpenSSF source...

CKAN MCP Server: MQA server allowlist bypass via unanchored regex (`isValidMqaServer`)

The ckangetmqaquality and ckangetmqaqualitydetails tools restrict their serverurl argument to dati.gov.it via a regular expression. The regex is anchored only at the start and places no boundary after the host, so any URL whose host merely begins with dati.gov.it — or that uses dati.gov.it as URL...