Executive brief
CKAN MCP Server, a data portal integration tool, caches API responses using insecurely-constructed cache keys that can collide due to missing escaping of special characters. An attacker can craft requests that produce identical cache keys as a victim's distinct requests, causing the victim to receive attacker-controlled data instead of their intended query results. In shared deployments (default configuration), this enables cache poisoning attacks that corrupt query integrity and can deliver malicious content to downstream AI models.
Technical details
The vulnerability is a cache-key canonicalization collision (CWE-436: Interpretation Conflict, CWE-345: Insufficient Verification of Data Authenticity). The `canonicalizeParams` function in `src/utils/cache.ts` joins sorted key-value pairs with unescaped `&` delimiters and does not escape `=` characters. The resulting string is then prefixed with `serverUrl` and `action` separated by unescaped `|` characters before hashing. This creates an ambiguity: parameters `{q: "budget", rows: 10}` and `{q: "budget&rows=10"}` both serialize to the same canonical string `q=budget&rows=10`. Additionally, objects and strings cannot be distinguished (e.g., `{filters: {a: "b"}}` vs `{filters: '{"a":"b"}'}` collide). An attacker can inject any canonical string into the alphabetically-first parameter name. On shared caches (enabled by default, including Cloudflare Workers' `caches.default` and Node.js in-process LRU), an attacker primes a colliding key so a victim's distinct query receives the attacker's cached response. Preconditions: caching must be enabled and the instance must be shared. Attack vector is network; no authentication or user interaction required. The fix requires encoding cache keys using percent-escaping, structured JSON with type tags, or a separator that cannot appear in encoded fields. Patch available in version 0.4.112.
Affected products
- ondata @aborruso/ckan-mcp-server < 0.4.112
Timeline
- 2026-09-03: disclosed: Published on GitHub Advisory Database
- 2026-09-03: patched: Version 0.4.112 released with fix