EUVD-2026-58724Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-reachable with no auth required, but AC:H because triggering the leak requires redirecting the upstream target; impact is confidentiality-only and limited in scope.
Primary rating from Vendor (github).
CVSS VectorVendor: github
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
3DescriptionCVE.org
CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, error paths reflect raw upstream response bodies and internal exception messages back to the caller instead of a sanitized, generic message. When the server is pointed at (or redirected/SSRF'd to) a host that returns a non-CKAN response, or when an internal exception occurs, the caller receives verbatim upstream content and internal detail (hostnames, internal IPs, DB errors, stack fragments). This vulnerability is fixed in 0.4.112.
AnalysisAI
Information disclosure in CKAN MCP Server prior to v0.4.112 exposes raw upstream HTTP response bodies, internal hostnames, IP addresses, database error messages, and stack fragments to callers via unsanitized error paths. The flaw is reachable over the network without authentication (CVSS AV:N/PR:N) but requires high complexity, specifically the ability to direct the server at a non-CKAN host - either legitimately or via SSRF chaining. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires either (a) the ability to configure or redirect the CKAN MCP Server's upstream target to a non-CKAN host, which implies some level of operator or configuration access, or (b) the existence of a separate SSRF vulnerability that allows an external attacker to redirect the server's outbound requests. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS base score of 3.7 (Low) is consistent with the actual risk profile: attack complexity is rated High (AC:H) because exploiting the information leak requires either privileged ability to redirect the server's upstream target or successful SSRF chaining against it, and confidentiality impact is Low (C:L) since leaked data is bounded to error-path content rather than full data exfiltration. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to CKAN MCP Server v0.4.112, which is confirmed released at https://github.com/ondata/ckan-mcp-server/releases/tag/v0.4.112 and fixes the error reflection issue by replacing verbatim upstream content in caller-facing errors with generic action-scoped messages and routing sensitive detail exclusively to server-side stderr. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-209 – Error Message Information Leak
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today