Description

CKAN MCP Server is a tool for querying CKAN open data portals. Prior to version 0.4.108, the SSRF guard `validateServerUrl` (added for CVE-2026-33060, extended for CVE-2026-53509) validates only the hostname string and never resolves DNS. Any caller-supplied `server_url` whose hostname *resolves* to an internal address passes the guard, so the server issues requests to loopback and cloud metadata (`169.254.169.254`). This is a third bypass of the same guard, and it reaches IMDS — strictly more than CVE-2026-53509, which only reached loopback. Version 0.4.108 contains an updated fix.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.7",
  "pubDate": "2026-09-21T18:17:09.073Z",
  "pubdate": "2026-09-21T18:17:09.073Z",
  "executiveSummary": "The CKAN MCP Server is susceptible to a Server-Side Request Forgery (SSRF) vulnerability resulting from an incomplete validation mechanism in the validateServerUrl function.\nThis vulnerability persists despite prior remediation attempts addressing CVE-2026-33060 and CVE-2026-53509, indicating a flawed architectural approach to URL validation.\nThe vulnerability allows an unauthenticated attacker to supply a malicious server_url that resolves to internal network resources, including the cloud Instance Metadata Service (IMDS) at 169.254.169.254.\nImpact includes unauthorized access to sensitive cloud environment metadata, potential exfiltration of credentials or configuration data, and the ability to interact with internal services that are not exposed to the public internet.\nThe vulnerability affects versions of the CKAN MCP Server prior to 0.4.108.\nThe primary risk stems from the bypass of network-level security controls, as the application assumes that hostname string validation is sufficient to prevent access to private IP ranges, failing to account for DNS resolution behaviors that allow attackers to point domain names to internal network targets.",
  "technicalDetails": "The core vulnerability lies within the validateServerUrl function, which is designed to implement SSRF protection for the CKAN MCP Server. Previous efforts to secure this function, specifically addressing CVE-2026-33060 and CVE-2026-53509, relied solely on pattern matching and string-based verification of the hostname provided in the server_url input parameter.\nThe root cause is a fundamental lack of DNS resolution during the validation phase. By performing only string analysis, the application fails to evaluate the actual destination IP address that the host resolves to at runtime. An attacker can register or use an existing domain name that points to an internal or reserved IP address, such as 169.254.169.254 (IMDS) or other loopback addresses.\nThe attack flow proceeds as follows: First, the attacker identifies the input vector where the server_url parameter is processed by the validateServerUrl function. Second, the attacker provides a hostname that satisfies the string-matching criteria defined in the function but resolves to a restricted internal network address via an attacker-controlled DNS server or a public domain pointing to an internal IP. Third, because the validateServerUrl function does not perform a DNS lookup or inspect the resolved IP, it erroneously deems the URL as safe and passes the validation check.\nOnce validation is bypassed, the application proceeds to initiate a request to the attacker-supplied, yet internally-resolving, destination. This enables the attacker to interact with the cloud provider's IMDS, which typically does not require authentication from within the instance, to exfiltrate identity tokens, environment variables, or other sensitive instance configuration data. This behavior represents a significant escalation over previous iterations of the vulnerability, which primarily allowed interaction with the loopback interface. This current bypass facilitates direct access to internal network infrastructure, potentially leading to further lateral movement within the cloud environment. The vulnerability remains present in all versions prior to 0.4.108, which includes the updated fix for this specific bypass. The lack of network-aware validation in the affected components creates a critical exposure point for any deployment relying on the CKAN MCP Server."
}