Executive brief
@aborruso/ckan-mcp-server is an AI assistant plugin (MCP server) that provides tools to query open data portals and databases. It fails to validate user-supplied URLs before making HTTP requests, allowing an attacker to inject malicious prompts that trick the AI into contacting internal systems, cloud credential endpoints, or performing SQL/SPARQL injection attacks. This could lead to unauthorized access to sensitive internal services and credential theft.
Technical details
The vulnerability exists in multiple tools (ckan_package_search, sparql_query, ckan_datastore_search_sql) that accept a base_url parameter and make HTTP requests without URL validation. The root cause is the absence of blocklists for private IP ranges (RFC 1918), link-local addresses (169.254.x.x), and cloud metadata endpoints. Exploitation requires prompt injection via malicious content (webpage, document) injected into the AI context while the MCP server is connected; no direct network access or authentication is required from the attacker. An attacker can achieve internal network scanning, cloud metadata credential theft (IMDS at 169.254.169.254), and SQL/SPARQL injection via unsanitized query parameters. The patch (version 0.4.85 and later) implements URL validation, allowlisting, and input sanitization.
Affected products
- @aborruso ckan-mcp-server < 0.4.85
Timeline
- 2026-03-18: disclosed: GHSA-3xm7-qw7j-qc8v published
- 2026-03-18: patched: Fix available in version 0.4.85
- 2026-03-20: advisory: CVE-2026-33060 published by NVD