Parameter Serialization Flaw in CKAN MCP Server Affects Data Security

CVE-2026-73846

What is CVE-2026-73846?

The CKAN MCP Server is a tool that allows querying CKAN open data portals. A flaw in the canonicalizeParams function, present in versions prior to 0.4.112, impacts the way request parameters are serialized. By failing to escape certain delimiters such as ampersands, equals signs, and vertical bars, an attacker could manipulate the application into colliding distinct logical parameter sets. This would enable them to prime a shared cache with responses that correspond to a victim's specific queries, risking data integrity and confidentiality. The issue has been rectified in the 0.4.112 update, emphasizing the importance of keeping software up to date.

References