CVE-2026-73845

Name of the Vulnerable Software and Affected Versions CKAN MCP Server versions prior to 0.4.112

Description The ckan get mqa quality() and ckan get mqa quality details() functions in src/tools/quality.ts use the isValidMqaServer function to validate the server url parameter. Because the validation uses a prefix-only regular expression for dati.gov.it, it is possible to bypass the allowlist using suffix-host or URL-userinfo values. This allows the request to target a host controlled by an attacker, which can then return a spoofed response.

Recommendations Update to version 0.4.112.