Docker CVE-2026-33060

The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) scores 5.3, indicating a medium severity rating that is tempered by high attack complexity (AC:H) and low privilege requirements. The high attack complexity factor reflects the practical reality that exploitation requires prompt injection through malicious content (a webpage, document, or other input processed by an AI assistant using this MCP server), not direct network access. The vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, suggesting limited real-world exploitation to date. However, the proof-of-concept is concrete and repeatable, the vulnerability class (SSRF leading to cloud credential theft) is well-understood and highly exploitable once conditions are met, and no rate limiting was observed in testing (9 requests to canary endpoint). The real-world risk is contingent on deployment scenarios: if this MCP server is integrated into an AI assistant used in environments with internet-facing LLM chatbots or document processing pipelines, the attack surface is significant. For isolated or internal-only deployments, risk is lower. SSVC would classify this as Exploitable (POC exists), not yet Widely Automatable (requires prompt injection precision), but with High Technical Impact (credential theft, internal reconnaissance). The patch availability from vendor reduces overall priority.

An attacker crafts a prompt injection attack embedded in a webpage or document that is processed by an AI assistant with the vulnerable @aborruso/ckan-mcp-server MCP integrated. The prompt causes the assistant to invoke ckan_package_search with a maliciously crafted base_url parameter pointing to http://169.254.169.254/latest/meta-data/iam/security-credentials, causing the MCP server to make an HTTP request to the AWS EC2 metadata service and return IAM credentials in the response, which the LLM model then echoes back to the attacker. Alternatively, an attacker could point base_url to internal services (e.g., http://192.168.1.100:8080/admin) to enumerate network topology. The proof-of-concept demonstrates that the server generates 9 unthrottled requests, confirming the absence of rate-limiting controls and successful exploitation.