MEDIUM5.7npm
GHSA-3xm7-qw7j-qc8v· CVE-2026-33060SSRF in @aborruso/ckan-mcp-server via base_url allows access to internal networks
Modified: 9/23/2026
package
npm/@aborruso/ckan-mcp-server
pkg:npm/%40aborruso/ckan-mcp-server
LOW3.7npm
GHSA-6f9w-9hf2-5rg3· CVE-2026-73844CKAN MCP Server: Information disclosure via verbose error reflection
Modified: 9/3/2026
MEDIUM6.5npm
GHSA-78x9-fhhx-v2g6· CVE-2026-73846CKAN MCP Server: Cache-key canonicalization collision enables cache confusion / poisoning
Modified: 9/3/2026
MEDIUM5.7npm
GHSA-798p-78g2-v556· CVE-2026-61612@aborruso/ckan-mcp-server has SSRF via DNS-name → internal IP — incomplete fix of CVE-2026-53509
Modified: 9/23/2026
MEDIUM5.3npm
GHSA-83x6-42hr-jc76· CVE-2026-73845CKAN MCP Server: MQA server allowlist bypass via unanchored regex (`isValidMqaServer`)
Modified: 9/2/2026
MEDIUM5.7npm
GHSA-g84h-j7jj-x32p· CVE-2026-53509@aborruso/ckan-mcp-server: SSRF via base_url allows access to internal networks (Potential fix bypass of CVE-2026-33060)
Modified: 9/23/2026