Description

CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, error paths reflect raw upstream response bodies and internal exception messages back to the caller instead of a sanitized, generic message. When the server is pointed at (or redirected/SSRF'd to) a host that returns a non-CKAN response, or when an internal exception occurs, the caller receives verbatim upstream content and internal detail (hostnames, internal IPs, DB errors, stack fragments). This vulnerability is fixed in 0.4.112.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.7",
  "pubDate": "2026-08-14T17:20:36.683Z",
  "pubdate": "2026-08-14T17:20:36.683Z",
  "executiveSummary": "CKAN MCP Server prior to version 0.4.112 suffers from an information disclosure vulnerability caused by improper error handling in error paths. The vulnerability allows callers to receive raw upstream response bodies and internal exception messages containing sensitive system details rather than sanitized, generic error responses.\nThe impact of this vulnerability includes the exposure of internal architecture details such as hostnames, internal IP addresses, database error messages, and stack fragments. This occurs when the server queries, is redirected to, or is subjected to Server-Side Request Forgery (SSRF) targeting a host that returns a non-CKAN response, or when internal exceptions are triggered.\nAttackers can leverage this behavior to map internal network topologies, identify underlying database technologies, and gather internal application state data, significantly aiding in subsequent targeted exploitation phases.\nThe affected product is CKAN MCP Server in versions prior to 0.4.112. Remediation requires upgrading the software to version 0.4.112 or later, where error paths are properly sanitized to return generic messages.",
  "technicalDetails": "The root cause of the vulnerability lies in the error-handling logic of error paths within CKAN MCP Server prior to version 0.4.112. Instead of intercepting upstream errors and internal application exceptions to return a standardized, sanitized, and generic error response to the caller, the application directly reflects the raw upstream response bodies and internal exception messages.\nThe vulnerable component is the error handling and response propagation subsystem of the CKAN MCP Server. When an interaction with an upstream server results in a non-CKAN response—whether induced directly, via redirection, or through Server-Side Request Forgery (SSRF)—or when an internal runtime exception occurs, the raw data payload is captured and returned downstream without sanitization.\nThe attack flow proceeds as follows: An attacker interacts with the CKAN MCP Server in a manner that triggers an upstream error or forces the server to query an arbitrary endpoint returning a non-CKAN format. Alternatively, the attacker triggers an internal application exception. Upon encountering the failure condition, the server captures the raw upstream response body or the internal exception message—which may contain hostnames, internal IP addresses, database error messages, and stack fragments—and transmits this data verbatim back to the caller in the error response payload.\nAuthentication and privilege requirements for triggering this behavior depend on the specific access controls of the deployed CKAN MCP Server instance and how the query or SSRF vector is invoked. Network exposure is inherent to the service listening for queries and processing upstream connections. Payload behavior involves the reflection of internal diagnostic data within error responses rather than malicious code execution.\nPost-exploitation impact is characterized by enhanced reconnaissance capabilities. By examining the leaked stack fragments, database errors, and internal network identifiers, an attacker can gain deep visibility into the internal architecture and operational state of the hosting environment, facilitating the design of further compound attacks."
}