9 matches found
@aborruso/ckan-mcp-server has SSRF via DNS-name → internal IP — incomplete fix of CVE-2026-53509
Summary The SSRF guard validateServerUrl added for CVE-2026-33060, extended for CVE-2026-53509 validates only the hostname string and never resolves DNS. Any caller-supplied serverurl whose hostname resolves to an internal address passes the guard, so the server issues requests to loopback and...
EUVD-2026-84031
@aborruso/ckan-mcp-server has SSRF via DNS-name → internal IP — incomplete fix of CVE-2026-53509...
GHSA-798P-78G2-V556 @aborruso/ckan-mcp-server has SSRF via DNS-name → internal IP — incomplete fix of CVE-2026-53509
Summary The SSRF guard validateServerUrl added for CVE-2026-33060, extended for CVE-2026-53509 validates only the hostname string and never resolves DNS. Any caller-supplied serverurl whose hostname resolves to an internal address passes the guard, so the server issues requests to loopback and...
@aborruso/ckan-mcp-server has SSRF via DNS-name → internal IP — incomplete fix of CVE-2026-53509
The SSRF guard validateServerUrl added for CVE-2026-33060, extended for CVE-2026-53509 validates only the hostname string and never resolves DNS. Any caller-supplied serverurl whose hostname resolves to an internal address passes the guard, so the server issues requests to loopback and cloud...
CVE-2026-61612
CKAN MCP Server is a tool for querying CKAN open data portals. Prior to version 0.4.108, the SSRF guard validateServerUrl added for CVE-2026-33060, extended for CVE-2026-53509 validates only the hostname string and never resolves DNS. Any caller-supplied serverurl whose hostname resolves to an...
CVE-2026-61612
The @aborruso/ckan-mcp-server (npm) component is vulnerable to Server-Side Request Forgery (SSRF) prior to version 0.4.108 . The root cause is a flaw in the validateServerUrl function within src/utils/http.ts, which validates only the hostname string without performing DNS resolution. This allows...
CVE-2026-61612 @aborruso/ckan-mcp-server has SSRF via DNS-name → internal IP — incomplete fix of CVE-2026-53509
CKAN MCP Server is a tool for querying CKAN open data portals. Prior to version 0.4.108, the SSRF guard validateServerUrl added for CVE-2026-33060, extended for CVE-2026-53509 validates only the hostname string and never resolves DNS. Any caller-supplied serverurl whose hostname resolves to an...
CVE-2026-61612 @aborruso/ckan-mcp-server has SSRF via DNS-name → internal IP — incomplete fix of CVE-2026-53509
CKAN MCP Server is a tool for querying CKAN open data portals. Prior to version 0.4.108, the SSRF guard validateServerUrl added for CVE-2026-33060, extended for CVE-2026-53509 validates only the hostname string and never resolves DNS. Any caller-supplied serverurl whose hostname resolves to an...
CVE-2026-61612: Server-Side Request Forgery (SSRF)
CKAN MCP Server is a tool for querying CKAN open data portals. Prior to version 0.4.108, the SSRF guard validateServerUrl added for CVE-2026-33060, extended for CVE-2026-53509 validates only the hostname string and never resolves DNS. Any caller-supplied serverurl whose hostname resolves to an...