CVE-2026-73846
Received Received - Intake

Cache Key Collision in CKAN MCP Server

Publication date: 2026-08-14

Last updated on: 2026-08-14

Assigner: GitHub, Inc.

Description
CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, canonicalizeParams in src/utils/cache.ts serializes request parameters with unescaped ampersand, equals-sign, and vertical-bar delimiters, allowing different logical parameter sets used by buildCacheKey to collide and an attacker to prime a shared cache with a response for a victim's distinct query. This issue is fixed in version 0.4.112.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-14
Last Modified
2026-08-14
Generated
2026-08-14
AI Q&A
2026-08-14
EPSS Evaluated
N/A
NVD
CVE-2026-73846
EUVD
EUVD-2026-58728

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
ckan ckan to 0.4.112 (inc)
ondata ckan_mcp_server 0.4.112
ondata ckan_mcp_server 0.4.111
ondata ckan_mcp_server 0.4.110
ondata ckan_mcp_server 0.4.109

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-436 Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.
CWE-345 The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a cache-key canonicalization collision in the CKAN MCP Server. The issue occurs because the canonicalizeParams function in src/utils/cache.ts joins sorted key-value pairs with unescaped delimiters like ampersand and equals-sign. This allows two different parameter sets to produce the same cache key, enabling cache poisoning where an attacker can prime the cache with a malicious response that a victim later receives for their distinct query.

Detection Guidance

To detect this vulnerability, inspect the cache key generation logic in CKAN MCP Server versions prior to 0.4.112. Check if canonicalizeParams uses unescaped delimiters like &, =, or | when serializing parameters. Commands include reviewing src/utils/cache.ts for improper parameter joining and verifying cache key collisions by sending crafted requests with different parameters that may produce identical cache keys.

Impact Analysis

An attacker could exploit this to serve incorrect or malicious data to users querying CKAN open data portals. This undermines trust in the tool's output and could lead to integrity issues. The impact is higher in shared cache environments like Cloudflare Workers or Node HTTP instances where multiple clients access the same cache.

Mitigation Strategies

Upgrade to CKAN MCP Server version 0.4.112 or later to address the cache-key collision issue. Additionally, partition shared caches per client/tenant to isolate cache entries. Review and apply other security fixes in the 0.4.112 release, such as SSRF protections, DoS limits, and transport security hardening.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73846. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart