CVE-2026-73846: CKAN MCP Server: Cache-key canonicalization collision enables cache confusion / poisoning

The response cache derives its key from an ambiguous string serialization of the request parameters. canonicalizeParams joins sorted ${key}=${value} pairs with & and does not escape &, =, or the | field separators used in buildCacheKey. Two different logical parameter sets can therefore serialize to the same key and share one cache entry. Because the cached value is whatever the upstream returned for whichever request populated the entry first, an attacker can prime a colliding key so a victim’s distinct query (same server_url) is served the attacker’s cached response.