CVE-2026-53509

Received Received - Intake

SSRF Bypass in CKAN MCP Server via Hostname Aliases

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description

CKAN MCP Server is a tool for querying CKAN open data portals. A known vulnerability CVE-2026-33060 indicated tools including ckan_package_search and sparql_query that accept a base_url parameter had the risk of making HTTP requests to arbitrary endpoints without restriction. A fix was applied to filter out ip addresses. However, a method to bypass exists prior to version 0.4.106. CKAN MCP Server validates caller-supplied CKAN server URLs by inspecting only the parsed hostname string before issuing outbound HTTP requests. In `src/utils/http.ts`, hostname aliases such as `ip6-localhost` are not equal to `localhost`, are not dotted IPv4 literals, and are not bracketed IPv6 literals, so they pass the SSRF filter but can resolve to loopback when the server performs the request. A remote MCP caller that can invoke CKAN tools with a `server_url` can therefore make the server connect to local or private addresses and, for CKAN-shaped responses, receive response-derived data. The updated fix in version 0.4.106 replaced the single `hostname === 'localhost'` check with a blocked-hostname `Set` covering `ip6-localhost` and `ip6-loopback`.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-21

Last Modified

2026-08-21

Generated

2026-08-22

AI Q&A

2026-08-22

EPSS Evaluated

N/A

NVD

CVE-2026-53509

Affected Vendors & Products

Vendor	Product	Version / Range
ckan	ckan_mcp_server	to 0.4.106 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

CKAN MCP Server before version 0.4.106 is vulnerable to Server-Side Request Forgery (SSRF) due to improper validation of the server_url parameter. The server checks only the hostname string and fails to block aliases like ip6-localhost, which resolve to loopback addresses. This allows attackers to make the server connect to local or private network addresses and receive response data.

Detection Guidance

This vulnerability involves SSRF via hostname aliases like ip6-localhost bypassing filters. To detect it, check if your CKAN MCP Server version is below 0.4.106. Inspect server logs for outbound requests to localhost or private IPs triggered by MCP caller tools like ckan_package_search or sparql_query with server_url parameters.

Impact Analysis

An attacker with access to the MCP caller could exploit this to access internal services, exfiltrate data, or perform unauthorized actions on behalf of the server. This could lead to data breaches, service disruption, or further network compromise if the server has access to sensitive systems.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations using affected versions may face compliance violations, legal penalties, and reputational damage.

Mitigation Strategies

Upgrade CKAN MCP Server to version 0.4.106 or later to apply the SSRF filter fix that blocks hostname aliases like ip6-localhost.

Hi! I’m here to help you understand CVE-2026-53509. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70