CVE-2026-76894: ckan-mcp-server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin "*" (out)

The MCP Apps UI resource (an interactive DataStore table rendered in the host’s webview/iframe) communicates with its parent via postMessage. Its inbound message listener performs no event.origin validation, and its outbound messages are sent with target origin '*'. Any window/frame able to reach the document can inject data into the table and interfere with the MCP UI handshake, and the UI’s own JSON-RPC messages are broadcast without an origin restriction.