CVE-2026-53509

@aborruso/ckan-mcp-server: SSRF via base_url allows access to internal networks (Potential fix bypass of CVE-2026-33060)

View on CVE.org
Published Aug 21, 2026 CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed
Description
CKAN MCP Server is a tool for querying CKAN open data portals. A known vulnerability CVE-2026-33060 indicated tools including ckan_package_search and sparql_query that accept a base_url parameter had the risk of making HTTP requests to arbitrary endpoints without restriction. A fix was applied to filter out ip addresses. However, a method to bypass exists prior to version 0.4.106. CKAN MCP Server validates caller-supplied CKAN server URLs by inspecting only the parsed hostname string before issuing outbound HTTP requests. In `src/utils/http.ts`, hostname aliases such as `ip6-localhost` are not equal to `localhost`, are not dotted IPv4 literals, and are not bracketed IPv6 literals, so they pass the SSRF filter but can resolve to loopback when the server performs the request. A remote MCP caller that can invoke CKAN tools with a `server_url` can therefore make the server connect to local or private addresses and, for CKAN-shaped responses, receive response-derived data. The updated fix in version 0.4.106 replaced the single `hostname === 'localhost'` check with a blocked-hostname `Set` covering `ip6-localhost` and `ip6-loopback`.

Analysis

AI-generated

Technical impact

CKAN MCP Server provides tools that query CKAN portals using a base_url parameter. The server validates only the parsed hostname string, so hostname aliases such as ip6‑localhost bypass the SSRF filter. An attacker who can invoke the server’s tools with a crafted server_url can force the server to issue HTTP requests to local or private addresses, allowing the attacker to read internal data or control services that the server can reach.

Affected Systems

The vulnerability affects the ondata:ckan-mcp-server package, specifically CKAN MCP Server versions before 0.4.106. These releases allowed the unfiltered base_url to be used in API calls that call CKAN tools such as ckan_package_search and sparql_query.

Risk and Exploitability

The CVSS score of 5.7 indicates a moderate severity, and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited exploitation data. However, the attack requires the ability to trigger a server‑side request via the exposed API, so an adversary would need at least network access to the CP server or the ability to compromise an authenticated user. The lack of an EPSS score does not preclude exploitation, but the exploit path is relatively straightforward once the required access is obtained.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade CKAN MCP Server to version 0.4.106 or later, which replaces the hostname check with a whitelist that blocks ip6‑localhost and ip6‑loopback.
  • Restrict access to the API endpoints that accept server_url by applying network policies or authentication so that only trusted clients can call them.
  • As a temporary safeguard, configure the underlying web server or reverse proxy to block outbound HTTP requests to internal or private address ranges from the CP server.

Generated by OpenCVE AI on August 21, 2026 at 22:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Github GHSA Github GHSA GHSA-g84h-j7jj-x32p @aborruso/ckan-mcp-server: SSRF via base_url allows access to internal networks (Potential fix bypass of CVE-2026-33060)
History
Type Values Removed Values Added
First Time appeared Ondata
Ondata ckan-mcp-server
Vendors & Products Ondata
Ondata ckan-mcp-server
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description CKAN MCP Server is a tool for querying CKAN open data portals. A known vulnerability CVE-2026-33060 indicated tools including ckan_package_search and sparql_query that accept a base_url parameter had the risk of making HTTP requests to arbitrary endpoints without restriction. A fix was applied to filter out ip addresses. However, a method to bypass exists prior to version 0.4.106. CKAN MCP Server validates caller-supplied CKAN server URLs by inspecting only the parsed hostname string before issuing outbound HTTP requests. In `src/utils/http.ts`, hostname aliases such as `ip6-localhost` are not equal to `localhost`, are not dotted IPv4 literals, and are not bracketed IPv6 literals, so they pass the SSRF filter but can resolve to loopback when the server performs the request. A remote MCP caller that can invoke CKAN tools with a `server_url` can therefore make the server connect to local or private addresses and, for CKAN-shaped responses, receive response-derived data. The updated fix in version 0.4.106 replaced the single `hostname === 'localhost'` check with a blocked-hostname `Set` covering `ip6-localhost` and `ip6-loopback`.
Title @aborruso/ckan-mcp-server: SSRF via base_url allows access to internal networks (Potential fix bypass of CVE-2026-33060)
Weaknesses CWE-918
References
Metrics cvssV3_1

{'score': 5.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N'}
Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)

Sources

Status
PUBLISHED
Assigner
GitHub_M
Published
Updated
Aug 21, 2026, 9:42 PM
Reserved
Jun 9, 2026, 5:05 PM

View source JSON

Updated
Aug 21, 2026, 9:35 PM

JSON

Status
Deferred
Published
Aug 21, 2026, 10:16 PM
Modified
Oct 12, 2026, 4:10 PM

View source JSON

No data.

Updated
Aug 21, 2026, 10:45 PM

JSON