CKAN MCP Server provides tools that query CKAN portals using a base_url parameter. The server validates only the parsed hostname string, so hostname aliases such as ip6‑localhost bypass the SSRF filter. An attacker who can invoke the server’s tools with a crafted server_url can force the server to issue HTTP requests to local or private addresses, allowing the attacker to read internal data or control services that the server can reach.

The vulnerability affects the ondata:ckan-mcp-server package, specifically CKAN MCP Server versions before 0.4.106. These releases allowed the unfiltered base_url to be used in API calls that call CKAN tools such as ckan_package_search and sparql_query.

The CVSS score of 5.7 indicates a moderate severity, and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited exploitation data. However, the attack requires the ability to trigger a server‑side request via the exposed API, so an adversary would need at least network access to the CP server or the ability to compromise an authenticated user. The lack of an EPSS score does not preclude exploitation, but the exploit path is relatively straightforward once the required access is obtained.