# CVE-2026-33060: SSRF in @aborruso/ckan-mcp-server via base_url allows access to internal networks

Source: https://junglewise.ai/threats/cve-2026-33060-ssrf-in-aborruso-ckan-mcp-server-via-base-url-allows-access-to  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-18. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-33060 · Severity: medium · CVSS 5.7 · Published 2026-03-18

@aborruso/ckan-mcp-server is an AI assistant plugin (MCP server) that provides tools to query open data portals and databases. It fails to validate user-supplied URLs before making HTTP requests, allowing an attacker to inject malicious prompts that trick the AI into contacting internal systems, cloud credential endpoints, or performing SQL/SPARQL injection attacks. This could lead to unauthorized access to sensitive internal services and credential theft.

Technologies: [@aborruso/ckan-mcp-server (npm)](https://junglewise.ai/threats/technologies/aborruso-ckan-mcp-server), [Ondata Ckan-Mcp-Server](https://junglewise.ai/threats/technologies/ckan-mcp-server). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Ondata](https://junglewise.ai/threats/vendors/ondata).

## Quick answers

**Is CVE-2026-33060 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-33060 being exploited in the wild.

**How severe is CVE-2026-33060?** Medium severity, with a CVSS score of 5.7, published 18 March 2026.

**Which products and versions are affected?** @aborruso/ckan-mcp-server (npm) < 0.4.85, SEMVER:introduced=0,fixed=0.4.85; Ondata Ckan-Mcp-Server < 0.4.85.

**Is there a fix for CVE-2026-33060?** Yes. @aborruso/ckan-mcp-server (npm): upgrade to 0.4.85 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-33060 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-33060?** Check whether you run @aborruso/ckan-mcp-server (npm) or Ondata Ckan-Mcp-Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @aborruso/ckan-mcp-server (npm): upgrade to 0.4.85 or later

  ```sh
  npm install @aborruso/ckan-mcp-server@0.4.85
  ```


## Technical details

The vulnerability exists in multiple tools (ckan_package_search, sparql_query, ckan_datastore_search_sql) that accept a base_url parameter and make HTTP requests without URL validation. The root cause is the absence of blocklists for private IP ranges (RFC 1918), link-local addresses (169.254.x.x), and cloud metadata endpoints. Exploitation requires prompt injection via malicious content (webpage, document) injected into the AI context while the MCP server is connected; no direct network access or authentication is required from the attacker. An attacker can achieve internal network scanning, cloud metadata credential theft (IMDS at 169.254.169.254), and SQL/SPARQL injection via unsanitized query parameters. The patch (version 0.4.85 and later) implements URL validation, allowlisting, and input sanitization.

## Affected products

- @aborruso ckan-mcp-server < 0.4.85

## Identifiers

- CVE-2026-33060
- GHSA-3xm7-qw7j-qc8v

## Timeline

- 2026-03-18: disclosed: GHSA-3xm7-qw7j-qc8v published
- 2026-03-18: patched: Fix available in version 0.4.85
- 2026-03-20: advisory: CVE-2026-33060 published by NVD

## References

- [https://github.com/ondata/ckan-mcp-server/security/advisories/GHSA-3xm7-qw7j-qc8v](https://github.com/ondata/ckan-mcp-server/security/advisories/GHSA-3xm7-qw7j-qc8v)
- [https://github.com/kysely-org/kysely/commit/0a602bff2f442f6c26d5e047ca8f8715179f6d24](https://github.com/kysely-org/kysely/commit/0a602bff2f442f6c26d5e047ca8f8715179f6d24)
- [https://github.com/ondata/ckan-mcp-server](https://github.com/ondata/ckan-mcp-server)

## Related threats

- [CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, the DataStore table UI in src/resources/datastore-table-ui.](https://junglewise.ai/threats/cve-2026-76894-ckan-mcp-server-datastore-table-ui-resource-does-not-validate)
- [@aborruso/ckan-mcp-server SSRF via DNS name resolution](https://junglewise.ai/threats/cve-2026-61612-aborruso-ckan-mcp-server-ssrf-via-dns-name-resolution)
- [CKAN MCP Server is a tool for querying CKAN open data portals. A known vulnerability indicated tools including ckan_package_s](https://junglewise.ai/threats/cve-2026-53509-aborruso-ckan-mcp-server-ssrf-via-hostname-alias-bypass)
- [CKAN MCP Server cache-key canonicalization collision](https://junglewise.ai/threats/cve-2026-73846-ckan-mcp-server-cache-key-canonicalization-collision)
- [CKAN MCP Server allowlist bypass via unanchored regex in MQA validation](https://junglewise.ai/threats/cve-2026-73845-ckan-mcp-server-allowlist-bypass-via-unanchored-regex-in-mqa)