EUVD-2026-58725Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-accessible SSRF allowlist bypass; C:L for request metadata sent to attacker host, I:L added for spoofed response corrupting data integrity returned to caller.
Primary rating from Vendor (github).
CVSS VectorVendor: github
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
3DescriptionCVE.org
CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, the ckan_get_mqa_quality and ckan_get_mqa_quality_details tools in src/tools/quality.ts use isValidMqaServer to validate the server_url parameter with a prefix-only regular expression for dati.gov.it, allowing suffix-host and URL-userinfo values to target an attacker-controlled host and return a spoofed response. This issue is fixed in version 0.4.112.
AnalysisAI
The ckan_get_mqa_quality and ckan_get_mqa_quality_details tools in CKAN MCP Server prior to 0.4.112 accept a server_url parameter validated only by a prefix-anchored regex, enabling attackers to bypass the dati.gov.it allowlist and redirect HTTP requests to attacker-controlled infrastructure via suffix-host (dati.gov.it.attacker.com) or RFC 3986 userinfo (dati.gov.it@attacker.com) techniques. The root cause is CWE-20 improper input validation - the regex tests only the string prefix, not the parsed hostname. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the ability to supply an arbitrary server_url value to the ckan_get_mqa_quality or ckan_get_mqa_quality_details MCP tools. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) correctly characterizes the low complexity of the bypass and the network-reachable attack vector, but the impact metrics warrant scrutiny. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who can influence the server_url argument in an MCP tool invocation - for example, via prompt injection into the AI assistant or direct access to the MCP interface - submits https://dati.gov.it@attacker.com/mqa. The unanchored regex accepts the URL, the MCP server issues an HTTP GET to attacker.com, and the attacker's server returns a crafted MQA quality response that the tool passes back to the AI orchestrator as legitimate government data. … |
| Remediation | Upgrade CKAN MCP Server to version 0.4.112 or later, confirmed as the fixed release at https://github.com/ondata/ckan-mcp-server/releases/tag/v0.4.112 and documented in the security advisory GHSA-83x6-42hr-jc76 (https://github.com/ondata/ckan-mcp-server/security/advisories/GHSA-83x6-42hr-jc76). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today