PT-2026-72067 · Unknown · Ckan-Mcp-Server

CVE-2026-73846

·

Published

2026-08-14

·

Updated

2026-09-03

CVSS v3.1

6.5

Medium

VectorAV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N
Name of the Vulnerable Software and Affected Versions CKAN MCP Server versions prior to 0.4.112
Description The canonicalizeParams function in src/utils/cache.ts serializes request parameters using unescaped ampersand, equals-sign, and vertical-bar delimiters. This flaw allows different logical parameter sets used by buildCacheKey to collide, enabling an attacker to prime a shared cache with a response intended for a victim's distinct query, leading to cache confusion or poisoning.
Recommendations Update to version 0.4.112.

Exploit

Fix

Insufficient Verification of Data Authenticity

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-345CWE-436

Related Identifiers

CVE-2026-73846
GHSA-78X9-FHHX-V2G6

Affected Products

Ckan-Mcp-Server