CVE-2026-73844lowCWE-209CWE-210

CVE-2026-73844: fallo de gravedad baja en ondata ckan-mcp-server

CKAN MCP Server: Information disclosure via verbose error reflection

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear ckan-mcp-server+ Monitorear @aborruso/ckan-mcp-server

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

8Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 3.7epss 0.4%
CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, error paths reflect raw upstream response bodies and internal exception messages back to the caller instead of a sanitized, generic message. When the server is pointed at (or redirected/SSRF'd to) a host that returns a non-CKAN response, or when an internal exception occurs, the caller receives verbatim upstream content and internal detail (hostnames, internal IPs, DB errors, stack fragments). This vulnerability is fixed in 0.4.112.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Productos afectados
ondata · ckan-mcp-server
CVEs relacionadas — ondata ckan-mcp-server

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-61612MEDIUM@aborruso/ckan-mcp-server has SSRF via DNS-name → internal IP — incomplete fix of CVE-2026-53509EPSS 0.4%CVE-2026-53509MEDIUM@aborruso/ckan-mcp-server: SSRF via base_url allows access to internal networks (Potential fix bypass of CVE-2026-33060)EPSS 0.4%CVE-2026-73845MEDIUMCKAN MCP Server: MQA server allowlist bypass via unanchored regex (`isValidMqaServer`)EPSS 0.4%CVE-2026-33060MEDIUMCKAN MCP Server: SSRF via base_url allows access to internal networksEPSS 0.3%CVE-2026-76894LOWCKAN MCP Server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin "*" (out)EPSS 0.2%CVE-2026-73846MEDIUMCKAN MCP Server: Cache-key canonicalization collision enables cache confusion / poisoningEPSS 0.2%