CVE-2026-73846

Summary

CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, canonicalizeParams in src/utils/cache.ts serializes request parameters with unescaped ampersand, equals-sign, and vertical-bar delimiters, allowing different logical parameter sets used by buildCacheKey to collide and an attacker to prime a shared cache with a response for a victim's distinct query. This issue is fixed in version 0.4.112.

Affected Software

VendorProductVersion RangeStatus
ondatackan-mcp-server< 0.4.112affected

Weaknesses

  • CWE-345: CWE-345: Insufficient Verification of Data Authenticity
  • CWE-436: CWE-436: Interpretation Conflict

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: poc
    • Automatable: no
    • Technical Impact: partial

Additional References

References