Executive brief
The CKAN MCP Server, a tool used for interacting with CKAN data platforms, is vulnerable to a security flaw that allows it to be tricked into making unauthorized requests to internal network services. An attacker could use this to bypass security filters and access sensitive data from private servers or local services that are not intended to be public. This issue is a bypass of a previous security fix.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in @aborruso/ckan-mcp-server due to insufficient validation of the 'base_url' parameter in tools like ckan_package_search and sparql_query. While the application attempted to filter 'localhost' and IP literals, it failed to account for hostname aliases such as 'ip6-localhost' and 'ip6-loopback' in src/utils/http.ts. A remote attacker with low privileges can provide these aliases to force the server to connect to internal or loopback addresses. If the internal service returns CKAN-formatted responses, the attacker can exfiltrate data. This vulnerability is a bypass of the fix for CVE-2026-33060 and is addressed in version 0.4.106.
Affected products
- @aborruso ckan-mcp-server < 0.4.106
Timeline
- 2026-05-31: disclosed: Initial publication to ondata/ckan-mcp-server
- 2026-07-07: advisory: GitHub Advisory published
- 2026-07-07: patched: Version 0.4.106 released with fix