CKAN MCP Server EUVD-2026-58725

Exploitation requires the ability to supply an arbitrary server_url value to the ckan_get_mqa_quality or ckan_get_mqa_quality_details MCP tools. In practice this means: (1) direct access to invoke MCP tool calls on the server (e.g., as an authorized user of the AI assistant), OR (2) successful prompt injection into an AI orchestrator that auto-invokes these tools with attacker-supplied parameters. The CVSS vector (PR:N, UI:N) reflects that no server-side authentication or user interaction gate is assumed, but realistically the MCP tool input channel must be reachable by or manipulable by the attacker. No special server configuration is required - the vulnerable regex was the default validation path for all invocations of the affected tools. Exploitation is limited to SSRF-style redirection and spoofed response injection; no remote code execution, lateral movement, or data exfiltration beyond request metadata is possible based on available data.

CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) correctly characterizes the low complexity of the bypass and the network-reachable attack vector, but the impact metrics warrant scrutiny. The vendor scored I:N; an independent assessment finds I:L more accurate because a spoofed MQA response corrupts the data integrity of what the tool returns to the AI orchestrator. No EPSS score was provided in the intelligence data - this cannot be assessed. The vulnerability is not in CISA KEV, and no public exploit code exists at the time of analysis. Practical exploitability is constrained by a prerequisite not captured in the CVSS vector: an attacker must be able to inject or control the server_url argument passed to the MCP tool, which typically requires influence over the AI prompting pipeline (prompt injection), a malicious user session, or a compromised orchestrator. This reduces real-world risk below what the PR:N vector might suggest in isolation. The fix is confirmed and straightforward to deploy - organizations running CKAN MCP Server should upgrade but this does not warrant emergency response cadence absent specific exposure of the MCP tool input layer to untrusted users.

An attacker who can influence the server_url argument in an MCP tool invocation - for example, via prompt injection into the AI assistant or direct access to the MCP interface - submits https://dati.gov.it@attacker.com/mqa. The unanchored regex accepts the URL, the MCP server issues an HTTP GET to attacker.com, and the attacker's server returns a crafted MQA quality response that the tool passes back to the AI orchestrator as legitimate government data. No public exploit code exists, but the bypass is trivially reproducible from the public advisory description.