CVE-2026-73844

3.7 Faible

Publiée le 14/08/2026 à 19:20 · Modifiée le 18/09/2026 à 22:09 · Analyse NVD reportée · Source : security-advisories@github.com

Description

CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, error paths reflect raw upstream response bodies and internal exception messages back to the caller instead of a sanitized, generic message. When the server is pointed at (or redirected/SSRF'd to) a host that returns a non-CKAN response, or when an internal exception occurs, the caller receives verbatim upstream content and internal detail (hostnames, internal IPs, DB errors, stack fragments). This vulnerability is fixed in 0.4.112.

Traduire en français

Produits concernés

ondata ckan-mcp-server

Scores CVSS

Version	Score	Source	Vecteur
3.1	3.7 Faible	security-advisories@github.com	`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N`

Faiblesses (CWE)

CWE-209
CWE-210

Références

https://github.com/ondata/ckan-mcp-server/commit/3b827af72b228d42aa7b0d7dac5347d16af3f4e5
https://github.com/ondata/ckan-mcp-server/releases/tag/v0.4.112
https://github.com/ondata/ckan-mcp-server/security/advisories/GHSA-6f9w-9hf2-5rg3

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories