CVE-2026-73844lowCWE-209CWE-210

CVE-2026-73844: low-severity vulnerability in ondata ckan-mcp-server

CKAN MCP Server: Information disclosure via verbose error reflection

Published · Updated

Follow this CVE+ Monitor ckan-mcp-server+ Monitor @aborruso/ckan-mcp-server

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 3.7epss 0.4%
CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, error paths reflect raw upstream response bodies and internal exception messages back to the caller instead of a sanitized, generic message. When the server is pointed at (or redirected/SSRF'd to) a host that returns a non-CKAN response, or when an internal exception occurs, the caller receives verbatim upstream content and internal detail (hostnames, internal IPs, DB errors, stack fragments). This vulnerability is fixed in 0.4.112.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
ondata · ckan-mcp-server
Related CVEs — ondata ckan-mcp-server

In the same product, most dangerous first.

CVE-2026-61612MEDIUM@aborruso/ckan-mcp-server has SSRF via DNS-name → internal IP — incomplete fix of CVE-2026-53509EPSS 0.4%CVE-2026-53509MEDIUM@aborruso/ckan-mcp-server: SSRF via base_url allows access to internal networks (Potential fix bypass of CVE-2026-33060)EPSS 0.4%CVE-2026-73845MEDIUMCKAN MCP Server: MQA server allowlist bypass via unanchored regex (`isValidMqaServer`)EPSS 0.4%CVE-2026-33060MEDIUMCKAN MCP Server: SSRF via base_url allows access to internal networksEPSS 0.3%CVE-2026-76894LOWCKAN MCP Server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin "*" (out)EPSS 0.2%CVE-2026-73846MEDIUMCKAN MCP Server: Cache-key canonicalization collision enables cache confusion / poisoningEPSS 0.2%