CVE-2026-73845
CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, the ckan_get_mqa_quality and ckan_get_mqa_quality_details tools in src/tools/quality.ts use isValidMqaServer to validate the server_url parameter with a prefix-only regular expression for dati.gov.it, allowing suffix-host and URL-userinfo values to target an attacker-controlled host and return a spoofed response. This issue is fixed in version 0.4.112.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 5.3
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- EPSS probability
- 0.22%
- CWE
- CWE-625, CWE-20, CWE-918
- Published
- 2026-08-14
- Last modified
- 2026-08-14
Affected products
- ondata ckan-mcp-server
Weakness type
Related vulnerabilities
- CVE-2026-79965 — Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to...
- CVE-2026-83618 — xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator
- CVE-2026-83617 — xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator
- CVE-2026-83609 — xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path
- CVE-2026-82726 — AshPhoenix get_subdomain maps a crafted or differently-cased Host header to an arbitrary tenant
- CVE-2026-55536 — Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92)
- CVE-2026-19278 — Stackrox: stackrox: privilege escalation via unanchored regular expressions in auth m2m role mappings
- CVE-2026-64940 — Tegalog -Fumy Otegaru Memo Logger- provided by Nishishi Factory contains a vulnerability due to a...