CKAN MCP Server’s URL validation only inspected the hostname string and ignored DNS resolution, allowing an attacker to supply a hostname that resolves to an internal IP. The server would then attempt to make requests to that address, enabling SSRF that could reach internal services, the loopback interface, and the cloud instance metadata service. Such access could expose confidential internal data or cloud credentials and serve as a foothold for further attacks.

All releases of CKAN MCP Server before version 0.4.108 are affected. The product, maintained by the ondata organization, is used to query CKAN open‑data portals and relies on the validateServerUrl guard to restrict outbound requests. Affected versions include any build without the 0.4.108 update that added DNS resolution checks.

The CVSS score is 5.7, indicating a moderate severity. EPSS data is not available and the flaw is not listed in the CISA KEV catalog. The likely attack vector is a remote attacker supplying a crafted server_url to an API endpoint; based on this description, the vulnerability can be exploited by redirecting the server to an internal IP that resolves from a supplied hostname. Because the guard never resolves DNS, the exploitability is significant until the patch is applied.