The vulnerability resides in CKAN MCP Server's handling of request parameters used to construct cache keys. The canonicalizeParams function serializes query parameters without escaping delimiters such as ampersand, equal sign, and vertical bar, allowing logically distinct parameter sets to produce identical cache keys. This flaw permits an attacker to inject a pre‑cached response that will subsequently be returned for a victim's legitimate query, leading to cache confusion and poisoning. The weakness is identified as CWE‑345 (Cache Timing or Cache Poisoning) and CWE‑436 (Integrity Failure through Incomplete Data Validation). Consequently, the integrity of cached responses is compromised, potentially causing clients to receive incorrect data and undermining trust in the data portal.

The affected product is CKAN MCP Server developed by ondata. Versions prior to 0.4.112 are vulnerable. The fix is implemented in release v0.4.112, which updates the canonicalization logic to properly escape delimiters. Systems running any earlier minor version are exposed to this issue.

The CVSS score of 6.5 indicates a medium severity vulnerability. The exploit path requires remote network access to the server and the ability to send crafted HTTP requests, which is a common attack vector for web services. EPSS data is not available, and the vulnerability is not currently listed in the CISA KEV catalog. Based on the available metrics and the lack of an advanced prerequisite, the likelihood of exploitation is moderate, but the impact on data integrity warrants timely remediation.