Improper Input Validation in CKAN MCP Server by OnData
CVE-2026-61612

5.7MEDIUM

Key Information:

Vendor

Ondata

Status
Ckan-mcp-server
Vendor
CVE Published:
21 September 2026

What is CVE-2026-61612?

The CKAN MCP Server, a tool for querying CKAN open data portals, contains an improper input validation flaw in its SSRF guard validateServerUrl. This guard, implemented to prevent Server-Side Request Forgery (SSRF) attacks, only validates the hostname string without performing DNS resolution. Consequently, if a server_url is provided that resolves to an internal address, the guard fails, allowing the server to issue requests to sensitive internal resources such as loopback or cloud metadata services. This vulnerability represents a repeated failure to protect against SSRF threats, with implications that extend beyond previous vulnerabilities. Users are urged to upgrade to version 0.4.108 or later, where this issue has been addressed.

Affected Version(s)

ckan-mcp-server @aborruso/ckan-mcp-server

References

https://github.com/ondata/ckan-mcp-server/security/adviso...
x_refsource_CONFIRM
https://github.com/ondata/ckan-mcp-server/commit/bb7439b5...
x_refsource_MISC
https://github.com/advisories/GHSA-3xm7-qw7j-qc8v
x_refsource_MISC

CVSS V3.1

Score:
5.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.