CKAN MCP Server CVE-2026-73846

Exploitation requires that the attacker and victim share the same running CKAN MCP Server process with a common in-process cache - for example, a multi-tenant or multi-agent deployment where multiple clients connect to one server instance. The attacker must be able to issue queries to the same server (authenticated or not at the application layer is not specified in the CVSS vector, which shows PR:N, meaning no privileges are required at the MCP server level). Successful exploitation also requires the attacker to issue the colliding-key request before the victim's legitimate request is served from cache (a timing dependency, reflected in AC:H). Exploitation is limited by: single-tenant or isolated-process deployments where no cache state is shared across users; the AC:H timing window requirement; and knowledge of the victim's query structure to construct a colliding parameter string. The flaw does not affect deployments where caching is disabled or where each user session has an isolated cache namespace.

The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N scores 6.5 (Medium), which is broadly consistent with independent assessment. AC:H accurately reflects that exploitation requires a race-condition style timing window: the attacker must prime the shared in-memory cache with a colliding key before a victim issues the legitimate query, and both parties must be routing through the same running CKAN MCP Server instance. This shared-cache requirement substantially limits the realistic attacker surface - it implies either a multi-tenant deployment where multiple external clients share one server process, or an internal attacker with access to the same deployment. The Integrity: High metric is well-justified: a successful collision lets the attacker substitute arbitrary cached content for the victim's query result, which could mean feeding fabricated dataset records or misleading metadata to an AI agent consuming the MCP output. Confidentiality: Low is plausible - a colliding key could also cause the server to return another user's prior query result to the attacker, leaking query content or result data. No EPSS data was supplied in the intelligence package, and the vulnerability has no CISA KEV listing and no publicly identified exploit code, suggesting it has not seen opportunistic mass exploitation. The attack is not trivially automatable due to the AC:H timing and shared-instance requirement, so real-world risk is most relevant to operators running CKAN MCP Server as a shared service for multiple users or agents simultaneously.

An attacker with access to a shared CKAN MCP Server instance - for example, as one of several AI agent sessions routed through a common server - crafts a query whose parameter value embeds delimiter characters matching a known or guessable victim query pattern. The attacker sends this crafted query first, priming the cache with a collision key bound to attacker-controlled content. When the victim agent subsequently issues its legitimate query, the server returns the attacker's cached result rather than querying the real CKAN portal, causing the AI agent to process fabricated or misleading dataset records. No public proof-of-concept exploit has been identified at time of analysis.