Ckan Mcp Server
Approved changes feed: RSS · Atom
cpe:2.3:a:ondata:ckan_mcp_server:*:*:*:*:*:node.js:*:*
part: a version: * update: *
| Vendor | Ondata (ef219995-4629-5120-82c1-adc800fd1a17) |
|---|---|
| Product | Ckan Mcp Server (e607bae7-046d-59a5-ad64-635fe6d7060a) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | node.js |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/ondata/ckan-mcp-server |
purl2cpe | 2026-07-28 16:41:11.944287 |
pkg:npm/@aborruso/ckan-mcp-server |
purl2cpe | 2026-06-01 10:16:18.680321 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-33060 |
vulnerable | 2026-06-08 07:57:18.526435 |
CKAN MCP Server: SSRF via base_url allows access to internal networks
MEDIUM (5.3)
CKAN MCP Server is a tool for querying CKAN open data portals. Versions prior to 0.4.85 provide tools including ckan_package_search and sparql_query that accept a base_url parameter, making HTTP requests to arbitrary endpoints without restriction. A CKAN portal client has no legitimate reason to contact cloud metadata or internal network services. There is no URL validation on base_url parameter. No private IP blocking (RFC 1918, link-local 169.254.x.x), no cloud metadata blocking. The sparql_query and ckan_datastore_search_sql tools also accept arbitrary base URLs and expose injection surfaces. An attack can lead to internal network scanning, cloud metadata theft (IAM credentials via IMDS at 169.254.169.254), potential SQL/SPARQL injection via unsanitized query parameters. Attack requires prompt injection to control the base_url parameter. This issue has been fixed in version 0.4.85.
Published: 2026-03-20T07:21:30.897Z
Updated: 2026-03-24T01:56:33.169Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.