CVE-2026-73844: CKAN MCP Server: Information disclosure via verbose error reflection

September 3, 2026

Error paths reflect raw upstream response bodies and internal exception messages back to the caller instead of a sanitized, generic message. When the server is pointed at (or redirected/SSRF’d to) a host that returns a non-CKAN response, or when an internal exception occurs, the caller receives verbatim upstream content and internal detail (hostnames, internal IPs, DB errors, stack fragments).

References

github.com/advisories/GHSA-6f9w-9hf2-5rg3
github.com/ondata/ckan-mcp-server/commit/3b827af72b228d42aa7b0d7dac5347d16af3f4e5
github.com/ondata/ckan-mcp-server/releases/tag/v0.4.112
github.com/ondata/ckan-mcp-server/security/advisories/GHSA-6f9w-9hf2-5rg3
nvd.nist.gov/vuln/detail/CVE-2026-73844

Code Behaviors & Features

Detect and mitigate CVE-2026-73844 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →