Executive brief
@aborruso/ckan-mcp-server is a Node.js package that exposes CKAN data via the Model Context Protocol. A server-side request forgery (SSRF) vulnerability allows attackers to bypass hostname validation by supplying a domain name that resolves to internal IP addresses (including cloud metadata endpoints). In unauthenticated HTTP deployments, remote attackers can request internal services and receive responses including sensitive data such as cloud IAM credentials.
Technical details
The SSRF guard `validateServerUrl` performs only hostname string validation and does not perform DNS resolution, allowing an attacker to supply a hostname that resolves to internal, private, or cloud-reserved addresses (10.x.x.x, 127.x.x.x, 169.254.169.254). The vulnerability exists in `src/utils/http.ts` and affects all tools that accept a `server_url` parameter. The attack vector is network-based and unauthenticated in default HTTP deployments. An attacker can retrieve non-blind responses from internal services, including IMDS metadata endpoints. This is the third bypass of the same guard, with prior fixes (CVE-2026-33060, CVE-2026-53509) addressing only string literals and failing to implement DNS resolution. No official patch has been released.
Affected products
- aborruso @ckan-mcp-server all versions through 0.4.107
Timeline
- 2026-09-22: disclosed: GHSA-798p-78g2-v556 published; identified as incomplete fix of CVE-2026-53509
- 2026-09-22: other: No patch available as of advisory date