CVE-2026-33060

Name of the Vulnerable Software and Affected Versions CKAN MCP Server versions prior to 0.4.85

Description The software allows making HTTP requests to arbitrary endpoints without restriction because it lacks URL validation on the base url parameter. This issue affects the ckan package search(), sparql query(), and ckan datastore search sql() functions. The absence of private IP blocking (RFC 1918 and link-local 169.254.x.x) and cloud metadata blocking enables attackers to perform internal network scanning and steal cloud metadata, such as IAM credentials via the Instance Metadata Service (IMDS) at 169.254.169.254. Additionally, unsanitized query parameters in these functions expose the system to potential SQL and SPARQL injection. Exploitation requires prompt injection to control the base url parameter.

Recommendations Update to version 0.4.85. Validate the base url parameter against a configurable allowlist of permitted CKAN portals. Block private IP ranges (RFC 1918 and link-local) and cloud metadata endpoints (169.254.169.254). Sanitize SQL input for datastore queries. Implement an allowlist for SPARQL endpoints.