Executive brief
The CKAN MCP Server is a middleware tool that interfaces with CKAN data repositories. When errors occur—either from upstream services or internal failures—the server returns raw error details and response content to callers, including internal IP addresses, database error messages, and server hostnames. An attacker can exploit this to discover internal infrastructure details and, when combined with Server-Side Request Forgery (SSRF) vulnerabilities, read sensitive content from internal endpoints.
Technical details
The vulnerability exists in two code paths: (1) `src/utils/http.ts` embeds the full decoded upstream response body in thrown `CkanApiError` exceptions via `JSON.stringify(decodedData)`, which are returned unfiltered to callers; (2) `src/worker.ts` catch-all handler returns raw `Error.message` in the JSON-RPC `data` field at HTTP 500 status. The root cause is absence of error message sanitization—no redaction or generic error wrapping occurs before responses reach callers. An attacker can leverage this as an information disclosure oracle: by pointing the server at internal endpoints (via SSRF), they receive forbidden response bodies embedded in error messages, converting blind SSRF into data-leaking SSRF. Additionally, network errors (e.g., `ECONNREFUSED 169.254.169.254:80`) leak target addresses and confirm internal infrastructure topology. The vulnerability requires network access to the MCP Server and no authentication; the server itself holds no credentials, but amplifies SSRF attack impact. A fix is available in version 0.4.112 and later, which redacts error content server-side and returns generic messages to callers.
Affected products
- ondata CKAN MCP Server < 0.4.112
Timeline
- 2026-07-09: disclosed
- 2026-09-03: advisory
- 2026-09-03: patched: Version 0.4.112 released with fix