CVE-2026-73846

Name of the Vulnerable Software and Affected Versions CKAN MCP Server versions prior to 0.4.112

Description The canonicalizeParams function in src/utils/cache.ts serializes request parameters using unescaped ampersand, equals-sign, and vertical-bar delimiters. This flaw allows different logical parameter sets used by buildCacheKey to collide, enabling an attacker to prime a shared cache with a response intended for a victim's distinct query, leading to cache confusion or poisoning.

Recommendations Update to version 0.4.112.