Vulnerability in CKAN MCP Server Allows Spoofing via Server URL Manipulation

CVE-2026-73845

What is CVE-2026-73845?

The CKAN MCP Server, a solution designed for querying CKAN open data portals, is susceptible to an issue where specific tools do not adequately validate the server_url parameter. Before version 0.4.112, the ckan_get_mqa_quality and ckan_get_mqa_quality_details tools rely on a regular expression that only checks the prefix for the dati.gov.it domain. This lax validation permits attackers to exploit suffix-host and URL-userinfo values, which can direct queries to an attacker-controlled server. This vulnerability can lead to spoofed responses, compromising the integrity of data provided by the CKAN MCP Server. Users are advised to upgrade to version 0.4.112 or later to mitigate this risk.

References