CKAN MCP Server CVE-2026-61612

Requires the CKAN MCP server (ondata/@aborruso ckan-mcp-server < 0.4.108) to be running and connected to a victim's AI assistant, and the attacker must supply a malicious server_url/base_url - realistically via prompt injection embedded in content the assistant processes (hence UI:R). The specific technical trigger is a hostname that passes the string-only validateServerUrl guard but RESOLVES via DNS to an internal address (documented examples: lvh.me→127.0.0.1, *.nip.io→169.254.169.254), reaching loopback and cloud IMDS. Limiting factors: exploitation depends on successful prompt injection while the server is connected; the fixed version additionally hardens the network-exposed HTTP transport by refusing to start without CKAN_ALLOWED_DOMAINS (default-deny, unless CKAN_HTTP_ALLOW_ALL=true), and the Cloudflare Worker deployment was never affected because the CF sandbox already blocks internal addresses. Cloud-hosted deployments where IMDS returns IAM credentials face the highest impact.

This is a genuine but conditionally-gated SSRF (CWE-918) in a niche MCP server, and the signals largely agree it is moderate rather than emergency. There is no CISA KEV listing and no structured POC flag for this specific bypass, so exploitation status is 'no public exploit identified at time of analysis' - though the bypass technique itself (DNS names like lvh.me→127.0.0.1 and *.nip.io→IMDS) is publicly documented in the fix log and a sibling advisory, lowering the effort to reproduce. EPSS, KEV and SSVC data were not supplied, so probabilistic exploitation cannot be quantified. The most important conflict is in the CVSS metrics: the supplied vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N (5.7), but the closely-related GHSA advisory explicitly argues Attack Complexity is HIGH because exploitation requires prompt injection of the victim's AI assistant while this MCP server is connected - a material precondition the AC:L rating understates. Impact is confidentiality-only (C:H) and credible: the flaw reaches the cloud metadata endpoint 169.254.169.254, meaning IAM credential theft, which the description notes is strictly worse than the prior CVE-2026-53509 (loopback only). Net: real priority for anyone running this MCP server against cloud infrastructure, but the prompt-injection + user-interaction gating keeps it out of 'critical, patch-tonight' territory.

An attacker plants a malicious webpage or document containing a prompt-injection payload that instructs a victim's AI assistant - which has the CKAN MCP server connected - to call ckan_package_search or sparql_query with a server_url whose hostname resolves to an internal address (e.g. a nip.io name mapping to 169.254.169.254). Because validateServerUrl only inspected the hostname string and never resolved DNS, the request passes the guard and the server fetches AWS/cloud metadata, returning IAM credentials into the assistant's context. No weaponized public exploit is cataloged for this specific third bypass, but the DNS-name bypass technique is documented in the vendor fix log.