{"id":"EUVD-2026-58724","enisaUuid":"5721db8d-6bb9-3d29-aa57-3650a095a388","description":"CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, error paths reflect raw upstream response bodies and internal exception messages back to the caller instead of a sanitized, generic message. When the server is pointed at (or redirected/SSRF\u0027d to) a host that returns a non-CKAN response, or when an internal exception occurs, the caller receives verbatim upstream content and internal detail (hostnames, internal IPs, DB errors, stack fragments). This vulnerability is fixed in 0.4.112.","datePublished":"Aug 14, 2026, 4:41:42 PM","dateUpdated":"Aug 18, 2026, 2:11:05 AM","baseScore":3.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","references":"https://github.com/ondata/ckan-mcp-server/security/advisories/GHSA-6f9w-9hf2-5rg3\nhttps://github.com/ondata/ckan-mcp-server/commit/3b827af72b228d42aa7b0d7dac5347d16af3f4e5\nhttps://github.com/ondata/ckan-mcp-server/releases/tag/v0.4.112\n","aliases":"CVE-2026-73844\nGHSA-6f9w-9hf2-5rg3\n","assigner":"GitHub_M","epss":0.36,"enisaIdProduct":[{"id":"c900e493-fbb0-3474-8beb-e61949ef7d05","product":{"name":"ckan-mcp-server","vendor":{"name":"ondata"}},"product_version":"\u003c 0.4.112"}],"enisaIdVendor":[{"id":"891d8b8d-26ff-370b-a3eb-61cb642405ba","vendor":{"name":"ondata"}}],"enisaIdVulnerability":[{"id":"0eb99759-ce19-3fba-a276-a6399144d64a","vulnerability":{"id":"CVE-2026-73844","description":"CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, error paths reflect raw upstream response bodies and internal exception messages back to the caller instead of a sanitized, generic message. When the server is pointed at (or redirected/SSRF\u0027d to) a host that returns a non-CKAN response, or when an internal exception occurs, the caller receives verbatim upstream content and internal detail (hostnames, internal IPs, DB errors, stack fragments). This vulnerability is fixed in 0.4.112.","datePublished":"Aug 14, 2026, 4:41:42 PM","dateUpdated":"Aug 18, 2026, 2:11:05 AM","status":"PUBLISHED","baseScore":3.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","references":"https://github.com/ondata/ckan-mcp-server/security/advisories/GHSA-6f9w-9hf2-5rg3\nhttps://github.com/ondata/ckan-mcp-server/commit/3b827af72b228d42aa7b0d7dac5347d16af3f4e5\nhttps://github.com/ondata/ckan-mcp-server/releases/tag/v0.4.112\n","enisa_id":"EUVD-2026-58724\n","assigner":"GitHub_M","epss":0.36,"dataProcessed":"Nov 5, 2026, 7:14:35 AM","vulnerabilityProduct":[{"id":"bfdefb57-996a-3206-88b4-764df24b2562","product":{"name":"ckan-mcp-server","vendor":{"name":"ondata"}},"product_version":"\u003c 0.4.112"}],"vulnerabilityVendor":[{"id":"a2c90636-804c-3c03-b29c-c464f93bcda6","vendor":{"name":"ondata"}}]}},{"id":"8cd34545-faf3-3f27-b228-4ae04910e963","vulnerability":{"id":"GHSA-6f9w-9hf2-5rg3","description":"CKAN MCP Server: Information disclosure via verbose error reflection","datePublished":"Sep 3, 2026, 2:49:10 PM","dateUpdated":"Sep 3, 2026, 2:49:10 PM","baseScore":0.0,"references":"https://github.com/ondata/ckan-mcp-server/security/advisories/GHSA-6f9w-9hf2-5rg3\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-73844\nhttps://github.com/ondata/ckan-mcp-server/commit/3b827af72b228d42aa7b0d7dac5347d16af3f4e5\nhttps://github.com/ondata/ckan-mcp-server\nhttps://github.com/ondata/ckan-mcp-server/releases/tag/v0.4.112\n","enisa_id":"EUVD-2026-58724\n","aliases":"GHSA-6f9w-9hf2-5rg3\nCVE-2026-73844\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:05:08 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}