CVE Feed

    Dashboard / CVE / CVE-2026-61612

    CVE-2026-61612

    CKAN MCP Server is a tool for querying CKAN open data portals. Prior to version 0.4.108, the SSRF guard `validateServerUrl` (added for CVE-2026-33060, extended for CVE-2026-53509) validates only the hostname string and never resolves DNS. Any caller-supplied `server_url` whose hostname *resolves* to an internal address passes the guard, so the server issues requests to loopback and cloud metadata (`169.254.169.254`). This is a third bypass of the same guard, and it reaches IMDS — strictly more than CVE-2026-53509, which only reached loopback. Version 0.4.108 contains an updated fix.

    Published:Sep 21, 2026
    Last Modified:Sep 21, 2026
    EPS:Sep 21, 2026
    EPSS Score:
    CVSS Score:5.7

    Affected Products

    Vendor
    Ondata
    Product
    Ckan-mcp-server

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-918 Server-Side Request Forgery

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-664 Server Side Request Forgery

    Related CVEs

    CVE-2026-76894 (CVSS 3.1) — CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, the DataStore table UI in src…
    CVE-2026-53509 (CVSS 5.7) — CKAN MCP Server is a tool for querying CKAN open data portals. A known vulnerability CVE-2026-33060 indicated …
    CVE-2026-73846 (CVSS 6.5) — CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, canonicalizeParams in src/uti…
    CVE-2026-73845 (CVSS 5.3) — CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, the ckan_get_mqa_quality and …
    CVE-2026-73844 (CVSS 3.7) — CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, error paths reflect raw upstr…
    CVE-2026-33060 (CVSS 5.3) — CKAN MCP Server is a tool for querying CKAN open data portals. Versions prior to 0.4.85 provide tools includin…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High