Description

CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, the ckan_get_mqa_quality and ckan_get_mqa_quality_details tools in src/tools/quality.ts use isValidMqaServer to validate the server_url parameter with a prefix-only regular expression for dati.gov.it, allowing suffix-host and URL-userinfo values to target an attacker-controlled host and return a spoofed response. This issue is fixed in version 0.4.112.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-14T17:20:36.820Z",
  "pubdate": "2026-08-14T17:20:36.820Z",
  "executiveSummary": "A URL validation bypass vulnerability exists in the CKAN MCP Server prior to version 0.4.112. The flaw resides within the ckan_get_mqa_quality and ckan_get_mqa_quality_details tools located in src/tools/quality.ts, where the isValidMqaServer function improperly validates the server_url parameter. By utilizing a prefix-only regular expression intended for dati.gov.it, the validation mechanism fails to adequately restrict domain boundaries. This allows an attacker to leverage suffix-host manipulation and URL-userinfo injection techniques to redirect requests to an attacker-controlled host. Consequently, the affected application processes spoofed responses from malicious external endpoints, posing risks to data integrity and system trust boundaries. Exploitation requires the ability to supply a crafted server_url parameter to the vulnerable tools, leading to potential data poisoning or unauthorized interaction with external malicious servers.",
  "technicalDetails": "The vulnerability stems from improper input validation logic implemented in the isValidMqaServer function within src/tools/quality.ts of the CKAN MCP Server. Specifically, the function utilizes a regular expression that performs only a prefix check to validate the server_url parameter against expected patterns for dati.gov.it. Because the regex lacks proper anchoring and domain boundary enforcement, it does not correctly evaluate the full host structure of the supplied Uniform Resource Identifier.\nAn attacker can exploit this weakness by constructing a specially crafted server_url incorporating suffix-host appending or URL-userinfo components (such as embedding credentials or '@' symbols). While the prefix matches the expected validation pattern, the underlying HTTP client resolves the destination host to an attacker-controlled infrastructure. When users invoke the ckan_get_mqa_quality or ckan_get_mqa_quality_details tools, the application initiates an outbound request to the attacker's server instead of the legitimate CKAN portal.\nThe attack flow proceeds as follows: First, the attacker identifies the exposure of the MQA quality query tools. Second, the attacker crafts a malicious server_url string that satisfies the weak prefix-only regular expression in isValidMqaServer while redirecting the network connection to a rogue endpoint via userinfo or suffix manipulation. Third, the victim or automated process submits the payload to the vulnerable MCP server tools. Fourth, the server processes the input, bypasses the flawed validation check, and queries the malicious endpoint. Fifth, the attacker's server returns a spoofed HTTP response containing manipulated quality metrics or data. Finally, the CKAN MCP Server consumes and processes this spoofed response, potentially leading to downstream logic flaws or misinformation within the client interface.\nThe vulnerability affects CKAN MCP Server versions prior to 0.4.112. The vulnerable components are specifically the ckan_get_mqa_quality and ckan_get_mqa_quality_details functions implemented in src/tools/quality.ts. The issue involves network exposure of the query tools accepting external parameters, and the payload behavior involves redirecting outbound requests to arbitrary external servers to return attacker-controlled data."
}