# CVE-2026-73845: CKAN MCP Server allowlist bypass via unanchored regex in MQA validation

Source: https://junglewise.ai/threats/cve-2026-73845-ckan-mcp-server-allowlist-bypass-via-unanchored-regex-in-mqa  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-14. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-73845 · Severity: medium · CVSS 5.3 · Published 2026-08-14

The CKAN MCP Server's MQA (data quality) tools contain a validation flaw that allows attackers to redirect requests to arbitrary hosts despite an intended restriction to dati.gov.it. By exploiting improper regex validation, an attacker can craft malicious URLs that pass validation while actually targeting attacker-controlled servers, enabling response spoofing and indirect injection of malicious content into model outputs.

Technologies: [@aborruso/ckan-mcp-server (npm)](https://junglewise.ai/threats/technologies/aborruso-ckan-mcp-server), [Ondata Ckan-Mcp-Server](https://junglewise.ai/threats/technologies/ckan-mcp-server). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Ondata](https://junglewise.ai/threats/vendors/ondata).

## Quick answers

**Is CVE-2026-73845 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-73845 being exploited in the wild.

**How severe is CVE-2026-73845?** Medium severity, with a CVSS score of 5.3, published 14 August 2026.

**Which products and versions are affected?** @aborruso/ckan-mcp-server (npm) < 0.4.112, SEMVER:introduced=0,fixed=0.4.112; Ondata Ckan-Mcp-Server < 0.4.112.

**Is there a fix for CVE-2026-73845?** Yes. @aborruso/ckan-mcp-server (npm): upgrade to 0.4.112 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-73845 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-73845?** Check whether you run @aborruso/ckan-mcp-server (npm) or Ondata Ckan-Mcp-Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @aborruso/ckan-mcp-server (npm): upgrade to 0.4.112 or later

  ```sh
  npm install @aborruso/ckan-mcp-server@0.4.112
  ```


## Technical details

The vulnerability is a permissive regular expression (CWE-625) combined with improper input validation (CWE-20) in the `isValidMqaServer()` function in src/tools/quality.ts. The regex `/^https?:\/\/(www\.)?dati\.gov\.it/i` is anchored only at the start and lacks a host boundary, allowing three bypass vectors: (1) domain suffix injection (e.g., `https://dati.gov.it.attacker.com/x` passes regex but targets attacker.com), (2) subdomain prefix injection (e.g., `http://dati.gov.it.evil.example/api` targets evil.example), and (3) URL userinfo abuse (e.g., `https://dati.gov.it@attacker.com/x` targets attacker.com). The validated URL then flows into `makeCkanRequest()`, issuing HTTP requests to the attacker-controlled host whose response is returned to the caller. This enables response spoofing, SSRF escalation beyond the intended domain restriction, and in agentic AI contexts, indirect prompt injection. Patch version 0.4.112 fixes the issue by parsing the URL and validating the hostname directly instead of regex matching.

## Affected products

- ondata ckan-mcp-server < 0.4.112

## Identifiers

- CVE-2026-73845
- GHSA-83x6-42hr-jc76

## Timeline

- 2026-09-02: disclosed: Advisory published on GitHub Advisory Database
- 2026-09-02: patched: Fixed in version 0.4.112

## References

- [https://api.github.com/users/Gal3m](https://api.github.com/users/Gal3m)
- [https://github.com/Gal3m](https://github.com/Gal3m)
- [https://api.github.com/users/Gal3m/gists%7B/gist_id%7D](https://api.github.com/users/Gal3m/gists%7B/gist_id%7D)
- [https://api.github.com/users/Gal3m/repos](https://api.github.com/users/Gal3m/repos)
- [https://avatars.githubusercontent.com/u/91008976?v=4](https://avatars.githubusercontent.com/u/91008976?v=4)
- [https://api.github.com/users/Gal3m/events%7B/privacy%7D](https://api.github.com/users/Gal3m/events%7B/privacy%7D)

## Related threats

- [CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, the DataStore table UI in src/resources/datastore-table-ui.](https://junglewise.ai/threats/cve-2026-76894-ckan-mcp-server-datastore-table-ui-resource-does-not-validate)
- [@aborruso/ckan-mcp-server SSRF via DNS name resolution](https://junglewise.ai/threats/cve-2026-61612-aborruso-ckan-mcp-server-ssrf-via-dns-name-resolution)
- [CKAN MCP Server is a tool for querying CKAN open data portals. A known vulnerability indicated tools including ckan_package_s](https://junglewise.ai/threats/cve-2026-53509-aborruso-ckan-mcp-server-ssrf-via-hostname-alias-bypass)
- [CKAN MCP Server cache-key canonicalization collision](https://junglewise.ai/threats/cve-2026-73846-ckan-mcp-server-cache-key-canonicalization-collision)
- [CKAN MCP Server information disclosure via error reflection](https://junglewise.ai/threats/cve-2026-73844-ckan-mcp-server-information-disclosure-via-error-reflection)