cve.bz

CVE-2026-73845

5.3 mediumEPSS 0.4%

Medium (5.3). EPSS 0.4% chance of exploitation in the next 30 days. Fixed in @aborruso/ckan-mcp-server 0.4.112.

CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, the ckan_get_mqa_quality and ckan_get_mqa_quality_details tools in src/tools/quality.ts use isValidMqaServer to validate the server_url parameter with a prefix-only regular expression for dati.gov.it, allowing suffix-host and URL-userinfo values to target an attacker-controlled host and return a spoofed response. This issue is fixed in version 0.4.112.

Severity

CVSS 3.1

5.3 medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS
0.4% chance of exploitation in the next 30 days; higher than 32% of CVEs (scores of 2026-10-31)
CWEs
CWE-20, CWE-625, CWE-918
Published
Modified
Record from
the NVD, synced

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-83x6-42hr-jc76npm@aborruso/ckan-mcp-server<0.4.1120.4.112

References

Check your stackJSON