ondata vulnerabilities

Products

• ckan-mcp-server 7
• ckan mcp server 1

Latest ondata CVEs

Newest publication first

1. CVE-2026-76894 CKAN MCP Server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin "*" (out)

   Published 2026-11-03

   Low·CVSS 3.1 EPSS 0.20%

   CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, the DataStore table UI in src/resources/datastore-table-ui.ts accepts window message events without validating event.origin and sends JSON-RPC messages through postMessage with a wildcard target orig...

2. CVE-2026-61612 @aborruso/ckan-mcp-server has SSRF via DNS-name → internal IP — incomplete fix of CVE-2026-53509

   Published 2026-09-21

   Medium·CVSS 5.7 EPSS 0.39%

   CKAN MCP Server is a tool for querying CKAN open data portals. Prior to version 0.4.108, the SSRF guard validateServerUrl (added for CVE-2026-33060, extended for CVE-2026-53509) validates only the hostname string and never resolves DNS. Any caller-supplied server_url whose hostna...

3. CVE-2026-53509 @aborruso/ckan-mcp-server: SSRF via base_url allows access to internal networks (Potential fix bypass of CVE-2026-33060)

   Published 2026-08-21

   Medium·CVSS 5.7 EPSS 0.38%

   CKAN MCP Server is a tool for querying CKAN open data portals. A known vulnerability CVE-2026-33060 indicated tools including ckan_package_search and sparql_query that accept a base_url parameter had the risk of making HTTP requests to arbitrary endpoints without restriction. A f...

4. CVE-2026-73846 CKAN MCP Server: Cache-key canonicalization collision enables cache confusion / poisoning

   Published 2026-08-14

   Medium·CVSS 6.5 EPSS 0.19%

   CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, canonicalizeParams in src/utils/cache.ts serializes request parameters with unescaped ampersand, equals-sign, and vertical-bar delimiters, allowing different logical parameter sets used by buildCache...

5. CVE-2026-73845 CKAN MCP Server: MQA server allowlist bypass via unanchored regex (`isValidMqaServer`)

   Published 2026-08-14

   Medium·CVSS 5.3 EPSS 0.38%

   CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, the ckan_get_mqa_quality and ckan_get_mqa_quality_details tools in src/tools/quality.ts use isValidMqaServer to validate the server_url parameter with a prefix-only regular expression for dati.gov.it...

6. CVE-2026-73844 CKAN MCP Server: Information disclosure via verbose error reflection

   Published 2026-08-14

   Low·CVSS 3.7 EPSS 0.36%

   CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, error paths reflect raw upstream response bodies and internal exception messages back to the caller instead of a sanitized, generic message. When the server is pointed at (or redirected/SSRF'd to) a...

7. CVE-2026-33060 CKAN MCP Server: SSRF via base_url allows access to internal networks

   Published 2026-03-20

   Medium·CVSS 5.7 EPSS 0.30%

   CKAN MCP Server is a tool for querying CKAN open data portals. Versions prior to 0.4.85 provide tools including ckan_package_search and sparql_query that accept a base_url parameter, making HTTP requests to arbitrary endpoints without restriction. A CKAN portal client has no legi...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.