CVE-2026-73845: CKAN MCP Server allowlist bypass via unanchored regex in MQA validation

CVE-2026-73845 · Severity: medium · CVSS 5.3 · Published 2026-08-14

The CKAN MCP Server's MQA (data quality) tools contain a validation flaw that allows attackers to redirect requests to arbitrary hosts despite an intended restriction to dati.gov.it. By exploiting improper regex validation, an attacker can craft malicious URLs that pass validation while actually targeting attacker-controlled servers, enabling response spoofing and indirect injection of malicious content into model outputs.

Technologies: @aborruso/ckan-mcp-server (npm), Ondata Ckan-Mcp-Server. Vendors: npm, Ondata.

Quick answers

Is CVE-2026-73845 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-73845 being exploited in the wild.
How severe is CVE-2026-73845?
Medium severity, with a CVSS score of 5.3, published 14 August 2026.
Which products and versions are affected?
@aborruso/ckan-mcp-server (npm) < 0.4.112, SEMVER:introduced=0,fixed=0.4.112; Ondata Ckan-Mcp-Server < 0.4.112.
Is there a fix for CVE-2026-73845?
Yes. @aborruso/ckan-mcp-server (npm): upgrade to 0.4.112 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-73845 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-73845?
Check whether you run @aborruso/ckan-mcp-server (npm) or Ondata Ckan-Mcp-Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @aborruso/ckan-mcp-server (npm): upgrade to 0.4.112 or later
    npm install @aborruso/ckan-mcp-server@0.4.112

Technical details

The vulnerability is a permissive regular expression (CWE-625) combined with improper input validation (CWE-20) in the `isValidMqaServer()` function in src/tools/quality.ts. The regex `/^https?:\/\/(www\.)?dati\.gov\.it/i` is anchored only at the start and lacks a host boundary, allowing three bypass vectors: (1) domain suffix injection (e.g., `https://dati.gov.it.attacker.com/x` passes regex but targets attacker.com), (2) subdomain prefix injection (e.g., `http://dati.gov.it.evil.example/api` targets evil.example), and (3) URL userinfo abuse (e.g., `https://dati.gov.it@attacker.com/x` targets attacker.com). The validated URL then flows into `makeCkanRequest()`, issuing HTTP requests to the attacker-controlled host whose response is returned to the caller. This enables response spoofing, SSRF escalation beyond the intended domain restriction, and in agentic AI contexts, indirect prompt injection. Patch version 0.4.112 fixes the issue by parsing the URL and validating the hostname directly instead of regex matching.

Affected products

  • ondata ckan-mcp-server < 0.4.112

Identifiers

  • CVE-2026-73845
  • GHSA-83x6-42hr-jc76

Timeline

  • 2026-09-02: disclosed: Advisory published on GitHub Advisory Database
  • 2026-09-02: patched: Fixed in version 0.4.112

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.