---
id: CVE-2026-73844
title: CKAN MCP Server is a tool for querying CKAN open data portals
summary: >-
  CKAN MCP Server is a tool for querying CKAN open data portals. Prior to
  0.4.112, error paths reflect raw upstream response bodies and internal
  exception messages back to the caller instead of a sanitized, generic message.
  When the server…
severity: low
cvss: 3.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-209
  - CWE-210
vendor: aborruso
product: '@aborruso/ckan-mcp-server'
affected:
  - '@aborruso/ckan-mcp-server < 0.4.112'
patched:
  - '@aborruso/ckan-mcp-server 0.4.112'
published: '2026-08-14'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T20:09:01.757'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-73844'
references:
  - url: >-
      https://github.com/ondata/ckan-mcp-server/commit/3b827af72b228d42aa7b0d7dac5347d16af3f4e5
    label: security-advisories@github.com
  - url: 'https://github.com/ondata/ckan-mcp-server/releases/tag/v0.4.112'
    label: security-advisories@github.com
  - url: >-
      https://github.com/ondata/ckan-mcp-server/security/advisories/GHSA-6f9w-9hf2-5rg3
    label: security-advisories@github.com
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-73844'
  - url: 'https://github.com/advisories/GHSA-6f9w-9hf2-5rg3'
tags:
  - nvd
  - ghsa
  - npm
epss: 0.00355
epssPercentile: 0.26527
aliases:
  - GHSA-6f9w-9hf2-5rg3
ecosystem: npm
ingestedAt: '2026-09-03T15:04:38.660Z'
---

## Overview

CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, error paths reflect raw upstream response bodies and internal exception messages back to the caller instead of a sanitized, generic message. When the server is pointed at (or redirected/SSRF'd to) a host that returns a non-CKAN response, or when an internal exception occurs, the caller receives verbatim upstream content and internal detail (hostnames, internal IPs, DB errors, stack fragments). This vulnerability is fixed in 0.4.112.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-73844)

Affected packages:

- `@aborruso/ckan-mcp-server < 0.4.112`

Patched in:

- `@aborruso/ckan-mcp-server 0.4.112`

Source: https://github.com/advisories/GHSA-6f9w-9hf2-5rg3