CVE-2026-33060: SSRF in @aborruso/ckan-mcp-server via base_url allows access to internal networks

CVE-2026-33060 · Severity: medium · CVSS 5.7 · Published 2026-03-18

@aborruso/ckan-mcp-server is an AI assistant plugin (MCP server) that provides tools to query open data portals and databases. It fails to validate user-supplied URLs before making HTTP requests, allowing an attacker to inject malicious prompts that trick the AI into contacting internal systems, cloud credential endpoints, or performing SQL/SPARQL injection attacks. This could lead to unauthorized access to sensitive internal services and credential theft.

Technologies: @aborruso/ckan-mcp-server (npm), Ondata Ckan-Mcp-Server. Vendors: npm, Ondata.

Quick answers

Is CVE-2026-33060 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-33060 being exploited in the wild.
How severe is CVE-2026-33060?
Medium severity, with a CVSS score of 5.7, published 18 March 2026.
Which products and versions are affected?
@aborruso/ckan-mcp-server (npm) < 0.4.85, SEMVER:introduced=0,fixed=0.4.85; Ondata Ckan-Mcp-Server < 0.4.85.
Is there a fix for CVE-2026-33060?
Yes. @aborruso/ckan-mcp-server (npm): upgrade to 0.4.85 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33060 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-33060?
Check whether you run @aborruso/ckan-mcp-server (npm) or Ondata Ckan-Mcp-Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @aborruso/ckan-mcp-server (npm): upgrade to 0.4.85 or later
    npm install @aborruso/ckan-mcp-server@0.4.85

Technical details

The vulnerability exists in multiple tools (ckan_package_search, sparql_query, ckan_datastore_search_sql) that accept a base_url parameter and make HTTP requests without URL validation. The root cause is the absence of blocklists for private IP ranges (RFC 1918), link-local addresses (169.254.x.x), and cloud metadata endpoints. Exploitation requires prompt injection via malicious content (webpage, document) injected into the AI context while the MCP server is connected; no direct network access or authentication is required from the attacker. An attacker can achieve internal network scanning, cloud metadata credential theft (IMDS at 169.254.169.254), and SQL/SPARQL injection via unsanitized query parameters. The patch (version 0.4.85 and later) implements URL validation, allowlisting, and input sanitization.

Affected products

  • @aborruso ckan-mcp-server < 0.4.85

Identifiers

  • CVE-2026-33060
  • GHSA-3xm7-qw7j-qc8v

Timeline

  • 2026-03-18: disclosed: GHSA-3xm7-qw7j-qc8v published
  • 2026-03-18: patched: Fix available in version 0.4.85
  • 2026-03-20: advisory: CVE-2026-33060 published by NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.