CVE-2026-53509

Name of the Vulnerable Software and Affected Versions CKAN MCP Server versions prior to 0.4.106

Description The software contains a Server-Side Request Forgery (SSRF) flaw where it validates caller-supplied URLs by inspecting only the parsed hostname string before issuing outbound HTTP requests. In src/utils/http.ts, hostname aliases like ip6-localhost bypass the filter because they are not equal to localhost, are not dotted IPv4 literals, and are not bracketed IPv6 literals, yet they resolve to loopback addresses during the request. A remote caller invoking tools such as ckan package search and sparql query via the server url or base url parameters can force the server to connect to local or private addresses and receive response-derived data.

Recommendations Update to version 0.4.106.