Is CVE-2026-53509 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-53509 being exploited in the wild.

How severe is CVE-2026-53509?

Medium severity, with a CVSS score of 5.7, published 21 August 2026.

Which products and versions are affected?

@aborruso/ckan-mcp-server (npm) < 0.4.106, SEMVER:introduced=0,fixed=0.4.106.

Is there a fix for CVE-2026-53509?

Yes. @aborruso/ckan-mcp-server (npm): upgrade to 0.4.106 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-53509 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-53509?

Check whether you run @aborruso/ckan-mcp-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-53509: CKAN MCP Server is a tool for querying CKAN open data portals. A known vulnerability indicated tools including ckan_package_s

Q: Is there a fix for CVE-2026-53509?

Yes. @aborruso/ckan-mcp-server (npm): upgrade to 0.4.106 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-53509 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-53509?

Check whether you run @aborruso/ckan-mcp-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-53509 · Severity: medium · CVSS 5.7 · Published 2026-08-21

The CKAN MCP Server, a tool used for interacting with CKAN data platforms, is vulnerable to a security flaw that allows it to be tricked into making unauthorized requests to internal network services. An attacker could use this to bypass security filters and access sensitive data from private servers or local services that are not intended to be public. This issue is a bypass of a previous security fix.

Technologies: @aborruso/ckan-mcp-server (npm). Vendors: npm.

Quick answers

Is CVE-2026-53509 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-53509 being exploited in the wild.
How severe is CVE-2026-53509?: Medium severity, with a CVSS score of 5.7, published 21 August 2026.
Which products and versions are affected?: @aborruso/ckan-mcp-server (npm) < 0.4.106, SEMVER:introduced=0,fixed=0.4.106.
Is there a fix for CVE-2026-53509?: Yes. @aborruso/ckan-mcp-server (npm): upgrade to 0.4.106 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-53509 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-53509?: Check whether you run @aborruso/ckan-mcp-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@aborruso/ckan-mcp-server (npm): upgrade to 0.4.106 or later
```
npm install @aborruso/ckan-mcp-server@0.4.106
```

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in @aborruso/ckan-mcp-server due to insufficient validation of the 'base_url' parameter in tools like ckan_package_search and sparql_query. While the application attempted to filter 'localhost' and IP literals, it failed to account for hostname aliases such as 'ip6-localhost' and 'ip6-loopback' in src/utils/http.ts. A remote attacker with low privileges can provide these aliases to force the server to connect to internal or loopback addresses. If the internal service returns CKAN-formatted responses, the attacker can exfiltrate data. This vulnerability is a bypass of the fix for CVE-2026-33060 and is addressed in version 0.4.106.

Affected products

@aborruso ckan-mcp-server < 0.4.106

Identifiers

CVE-2026-53509
GHSA-g84h-j7jj-x32p

Timeline

2026-05-31: disclosed: Initial publication to ondata/ckan-mcp-server
2026-07-07: advisory: GitHub Advisory published
2026-07-07: patched: Version 0.4.106 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.