CVE-2026-73844
Received Received - Intake

Information Exposure in CKAN MCP Server

Publication date: 2026-08-14

Last updated on: 2026-08-14

Assigner: GitHub, Inc.

Description
CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, error paths reflect raw upstream response bodies and internal exception messages back to the caller instead of a sanitized, generic message. When the server is pointed at (or redirected/SSRF'd to) a host that returns a non-CKAN response, or when an internal exception occurs, the caller receives verbatim upstream content and internal detail (hostnames, internal IPs, DB errors, stack fragments). This vulnerability is fixed in 0.4.112.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-14
Last Modified
2026-08-14
Generated
2026-08-14
AI Q&A
2026-08-14
EPSS Evaluated
N/A
NVD
CVE-2026-73844
EUVD
EUVD-2026-58724

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ckan ckan to 0.4.112 (inc)
ondata ckan_mcp_server to 0.4.112 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-210 The product identifies an error condition and creates its own diagnostic or error messages that contain sensitive information.
CWE-209 The product generates an error message that includes sensitive information about its environment, users, or associated data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-73844 is an information disclosure vulnerability in the CKAN MCP Server affecting versions before 0.4.112. It occurs when the server reflects raw upstream response bodies and internal exception messages back to callers instead of sanitized generic messages. This exposes sensitive details like hostnames, internal IPs, DB errors, and stack traces.

Detection Guidance

To detect this vulnerability, monitor error responses from the CKAN MCP Server for raw upstream content or internal details like hostnames, IPs, or stack traces. Check if error messages include unexpected data such as database errors or SSRF-related responses. Use network inspection tools to observe if the server reflects upstream responses verbatim.

Impact Analysis

Attackers can exploit this to read arbitrary internal responses via SSRF vectors by redirecting the server to internal endpoints. They may also obtain operational details like internal IP addresses, node error codes, and stack traces, which could aid further attacks.

Mitigation Strategies

Immediately upgrade the CKAN MCP Server to version 0.4.112 or later. Ensure error messages returned to callers are generic and sanitized, while logging detailed errors server-side. Review and restrict SSRF vectors by validating all outbound requests and blocking internal endpoint access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73844. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart