CKAN MCP Server EUVD-2026-58724

Exploitation requires either (a) the ability to configure or redirect the CKAN MCP Server's upstream target to a non-CKAN host, which implies some level of operator or configuration access, or (b) the existence of a separate SSRF vulnerability that allows an external attacker to redirect the server's outbound requests. The CVSS AC:H rating reflects this prerequisite. Without one of these conditions, an attacker cannot trigger the error path that reflects sensitive content. Limiting factors: the attacker must be able to observe the caller-facing error response, meaning they must have access to the MCP client session or the JSON-RPC reply channel. No user interaction is required once access conditions are met. There is no requirement for a specific non-default CKAN configuration - the flaw is in the error handling code that runs whenever an unexpected upstream response or internal exception occurs.

The CVSS base score of 3.7 (Low) is consistent with the actual risk profile: attack complexity is rated High (AC:H) because exploiting the information leak requires either privileged ability to redirect the server's upstream target or successful SSRF chaining against it, and confidentiality impact is Low (C:L) since leaked data is bounded to error-path content rather than full data exfiltration. EPSS data was not provided, and there is no CISA KEV listing and no known public exploit, all of which align with a low real-world exploitation probability. The practical threat is most relevant to deployments where the MCP server is accessible to multiple callers or where an upstream SSRF condition already exists - in those scenarios leaked hostnames, internal IPs, or DB error strings could meaningfully advance a subsequent attack. For a typical single-operator or isolated deployment, the blast radius is narrow. No conflicting signals were observed between the CVSS vector and the description: the network-accessible, unauthenticated but high-complexity rating is well-supported by the mechanics.

An attacker with network access to the MCP server - or an internal caller - directs the server at a host returning a non-CKAN HTTP response, either by controlling the upstream configuration or by chaining an SSRF condition. The server's error handler returns the raw upstream body verbatim to the caller, potentially leaking internal hostnames, IP addresses, database connection strings, or stack traces. No public exploit code has been identified at time of analysis, but the mechanics are straightforward for any caller who can influence the upstream target.