CKAN MCP Server, used for querying CKAN open‑data portals, has a Server‑Side Request Forgery flaw in its ckan_package_search and sparql_query tools. The tools accept a base_url parameter that is passed directly to an HTTP client without any form of validation or blocking of internal addresses. An attacker who can influence the base_url value can cause the server to make outgoing requests to arbitrary endpoints, including private networks or cloud metadata services such as 169.254.169.254. This can lead to internal network reconnaissance, theft of IAM credentials via the Instance Metadata Service, or injection of malicious SQL/SPARQL queries through unsanitized query parameters. The weakness is classified as CWE‑918, reflecting unsanitized external redirection.

The vulnerability is present in the ondata:ckan-mcp-server product in all released versions prior to 0.4.85. Early releases of the tool expose the ckan_package_search, sparql_query, ckan_datastore_search_sql, and ckan_datastore_search_sql tools to the flaw. The issue was resolved in version 0.4.85, which implements proper URL validation and blocking of internal ranges.

The CVSS base score of 5.3 indicates a moderate impact. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to be able to supply a crafted base_url parameter; normally this is provided by a CKAN portal client, but the client lacks any legitimate reason to target internal network services. Therefore, the risk is moderate to high if the CKAN MCP Server is exposed to untrusted or third‑party clients, as the attacker could perform internal network scans, retrieve cloud credentials, or inject malformed queries.