CVE-2026-73844lowCWE-209CWE-210

CVE-2026-73844: falha de baixa gravidade em ondata ckan-mcp-server

CKAN MCP Server: Information disclosure via verbose error reflection

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar ckan-mcp-server+ Monitorar @aborruso/ckan-mcp-server

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

8Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 3.7epss 0.4%
CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, error paths reflect raw upstream response bodies and internal exception messages back to the caller instead of a sanitized, generic message. When the server is pointed at (or redirected/SSRF'd to) a host that returns a non-CKAN response, or when an internal exception occurs, the caller receives verbatim upstream content and internal detail (hostnames, internal IPs, DB errors, stack fragments). This vulnerability is fixed in 0.4.112.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
ondata · ckan-mcp-server
CVEs relacionadas — ondata ckan-mcp-server

No mesmo produto, das mais perigosas para as menos.

CVE-2026-61612MEDIUM@aborruso/ckan-mcp-server has SSRF via DNS-name → internal IP — incomplete fix of CVE-2026-53509EPSS 0.4%CVE-2026-53509MEDIUM@aborruso/ckan-mcp-server: SSRF via base_url allows access to internal networks (Potential fix bypass of CVE-2026-33060)EPSS 0.4%CVE-2026-73845MEDIUMCKAN MCP Server: MQA server allowlist bypass via unanchored regex (`isValidMqaServer`)EPSS 0.4%CVE-2026-33060MEDIUMCKAN MCP Server: SSRF via base_url allows access to internal networksEPSS 0.3%CVE-2026-73846MEDIUMCKAN MCP Server: Cache-key canonicalization collision enables cache confusion / poisoningEPSS 0.2%