{"id":"EUVD-2026-58728","enisaUuid":"0db81dc9-a941-346f-aae9-04578907f640","description":"CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, canonicalizeParams in src/utils/cache.ts serializes request parameters with unescaped ampersand, equals-sign, and vertical-bar delimiters, allowing different logical parameter sets used by buildCacheKey to collide and an attacker to prime a shared cache with a response for a victim\u0027s distinct query. This issue is fixed in version 0.4.112.","datePublished":"Aug 14, 2026, 4:56:23 PM","dateUpdated":"Aug 17, 2026, 7:32:41 PM","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","references":"https://github.com/ondata/ckan-mcp-server/security/advisories/GHSA-78x9-fhhx-v2g6\nhttps://github.com/ondata/ckan-mcp-server/commit/8e1522f9bbfa1f3b21550f17887f60f133e24151\nhttps://github.com/ondata/ckan-mcp-server/releases/tag/v0.4.112\n","aliases":"CVE-2026-73846\nGHSA-78x9-fhhx-v2g6\n","assigner":"GitHub_M","epss":0.19,"enisaIdProduct":[{"id":"c39b90a8-0e74-3647-96f4-e4c9285ba40f","product":{"name":"ckan-mcp-server","vendor":{"name":"ondata"}},"product_version":"\u003c 0.4.112"}],"enisaIdVendor":[{"id":"167d1d92-fcd1-3465-a387-5e68c4c77597","vendor":{"name":"ondata"}}],"enisaIdVulnerability":[{"id":"53f3ae78-2593-3d0b-9113-a0b88d6399f9","vulnerability":{"id":"CVE-2026-73846","description":"CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, canonicalizeParams in src/utils/cache.ts serializes request parameters with unescaped ampersand, equals-sign, and vertical-bar delimiters, allowing different logical parameter sets used by buildCacheKey to collide and an attacker to prime a shared cache with a response for a victim\u0027s distinct query. This issue is fixed in version 0.4.112.","datePublished":"Aug 14, 2026, 4:56:23 PM","dateUpdated":"Aug 17, 2026, 7:32:41 PM","status":"PUBLISHED","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","references":"https://github.com/ondata/ckan-mcp-server/security/advisories/GHSA-78x9-fhhx-v2g6\nhttps://github.com/ondata/ckan-mcp-server/commit/8e1522f9bbfa1f3b21550f17887f60f133e24151\nhttps://github.com/ondata/ckan-mcp-server/releases/tag/v0.4.112\n","enisa_id":"EUVD-2026-58728\n","assigner":"GitHub_M","epss":0.19,"dataProcessed":"Nov 15, 2026, 7:18:17 AM","vulnerabilityProduct":[{"id":"73b33360-d13e-342b-aad7-1e2f45d707f5","product":{"name":"ckan-mcp-server","vendor":{"name":"ondata"}},"product_version":"\u003c 0.4.112"}],"vulnerabilityVendor":[{"id":"da546a08-c6c8-35c3-8a3f-cbf4ec863458","vendor":{"name":"ondata"}}]}},{"id":"a11d29b0-c2e7-3819-8143-710492c8c2a5","vulnerability":{"id":"GHSA-78x9-fhhx-v2g6","description":"CKAN MCP Server: Cache-key canonicalization collision enables cache confusion / poisoning","datePublished":"Sep 3, 2026, 2:49:22 PM","dateUpdated":"Sep 3, 2026, 2:49:22 PM","baseScore":0.0,"references":"https://github.com/ondata/ckan-mcp-server/security/advisories/GHSA-78x9-fhhx-v2g6\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-73846\nhttps://github.com/ondata/ckan-mcp-server/commit/8e1522f9bbfa1f3b21550f17887f60f133e24151\nhttps://github.com/ondata/ckan-mcp-server\nhttps://github.com/ondata/ckan-mcp-server/releases/tag/v0.4.112\n","enisa_id":"EUVD-2026-58728\n","aliases":"GHSA-78x9-fhhx-v2g6\nCVE-2026-73846\n","epss":0.0,"dataProcessed":"Nov 15, 2026, 2:54:50 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}