Remote Code Execution Vulnerability in CKAN MCP Server by OnData
CVE-2026-53509

5.7MEDIUM

Key Information:

Vendor

Ondata

Status
Ckan-mcp-server
Vendor
CVE Published:
21 August 2026

What is CVE-2026-53509?

The CKAN MCP Server allows a remote caller to exploit a Server-Side Request Forgery (SSRF) vulnerability that occurs due to insufficient validation of server URLs. Specifically, prior to version 0.4.106, the server inadequately checks caller-supplied URLs, allowing for outbound requests to local or private addresses. Attackers can circumvent protection filters by utilizing hostname aliases such as 'ip6-localhost', which the server incorrectly identifies as safe. The issue allows for potential exposure of sensitive data, as attackers can receive responses from requests made to these addresses. This vulnerability emphasizes the importance of strict URL validation and the need for upgrading to the latest version to mitigate such risks.

Affected Version(s)

ckan-mcp-server < 0.4.106

References

https://github.com/ondata/ckan-mcp-server/security/adviso...
x_refsource_CONFIRM
https://github.com/advisories/GHSA-3xm7-qw7j-qc8v
x_refsource_MISC
https://github.com/ondata/ckan-mcp-server/releases/tag/v0...
x_refsource_MISC

CVSS V3.1

Score:
5.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.