EUVD-2026-64173
GHSA-g84h-j7jj-x32p
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
PR:L reflects required MCP session; UI:N because attacker directly triggers the SSRF without needing a separate victim action; C:H for internal data exposure; I:N and A:N as no write or availability impact is described.
Primary rating from Vendor (https://github.com/ondata/ckan-mcp-server).
CVSS VectorVendor: https://github.com/ondata/ckan-mcp-server
Lifecycle Timeline
1DescriptionCVE.org
Summary
A known vulnerability CVE-2026-33060 indicated tools including ckan_package_search and sparql_query that accept a base_url parameter had the risk of making HTTP requests to arbitrary endpoints without restriction. A fix was applied to filter out ip addresses. However, a method to bypass exists.
Details
CKAN MCP Server validates caller-supplied CKAN server URLs by inspecting only the parsed hostname string before issuing outbound HTTP requests. In src/utils/http.ts, hostname aliases such as ip6-localhost are not equal to localhost, are not dotted IPv4 literals, and are not bracketed IPv6 literals, so they pass the SSRF filter but can resolve to loopback when the server performs the request. A remote MCP caller that can invoke CKAN tools with a server_url can therefore make the server connect to local or private addresses and, for CKAN-shaped responses, receive response-derived data.
Fix
Replaced the single hostname === 'localhost' check with a blocked-hostname Set covering ip6-localhost and ip6-loopback. Patched in commit c761045a1b7c5f40d2626540dd2ef1d4feb91f8c.
--- @aborruso/ckan-mcp-server thanks hibrian827 for responsibly disclosing this issue.
AnalysisAI
SSRF filter bypass in CKAN MCP Server (@aborruso/ckan-mcp-server) allows a low-privileged remote MCP caller to reach loopback and private network addresses by supplying hostname aliases such as 'ip6-localhost' as the server_url parameter to CKAN tools like ckan_package_search and sparql_query. The prior remediation for CVE-2026-33060 hardened only against dotted IPv4 literals, bracketed IPv6 literals, and the exact string 'localhost', leaving non-canonical loopback aliases unblocked in src/utils/http.ts. No public exploit code has been identified at time of analysis, and no active exploitation has been confirmed by CISA KEV; however, the bypass technique is straightforward given knowledge of the prior fix.
Technical ContextAI
CKAN MCP Server is a Node.js/TypeScript Model Context Protocol server (npm package @aborruso/ckan-mcp-server) that bridges MCP-compatible AI agents to CKAN open data portals. The vulnerability resides in src/utils/http.ts, which performs a caller-supplied URL validation step before issuing outbound HTTP requests. The original SSRF fix (CVE-2026-33060) compared the parsed hostname against 'localhost', rejected dotted-decimal IPv4 private ranges, and rejected bracketed IPv6 addresses. CWE-918 (Server-Side Request Forgery) applies because the blocklist is an incomplete denylist: the Linux system hostname alias 'ip6-localhost' (and 'ip6-loopback', present in /etc/hosts on many Linux distributions) resolves to the loopback address ::1 but is a plain string that passes all three checks. The root cause is an allowlist/blocklist coverage gap common in SSRF mitigations that enumerate literals rather than resolving and checking the final network address.
RemediationAI
Upgrade to @aborruso/ckan-mcp-server v0.4.106 or later, which includes the fix introduced in commit c761045a1b7c5f40d2626540dd2ef1d4feb91f8c. The patch replaces the single 'hostname === localhost' equality check with a blocked-hostname Set that also covers 'ip6-localhost' and 'ip6-loopback'. The release tag is available at https://github.com/ondata/ckan-mcp-server/releases/tag/v0.4.106. If upgrading immediately is not possible, operators should restrict which MCP callers are permitted to invoke CKAN tools with arbitrary server_url values - treating server_url as an untrusted input and enforcing an allowlist of approved CKAN portal hostnames at the application or network layer. A network-level compensating control is to block outbound HTTP from the MCP server process to loopback (127.0.0.1, ::1) and RFC-1918 private ranges via host firewall rules; note this does not fix the code path but limits blast radius. Be aware that allowlist enforcement may break legitimate use of self-hosted CKAN instances if their hostnames are not pre-approved.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today