Skip to main content
cve.nowby Sazabi
← npm
npmPackage

@aborruso/ckan-mcp-server

6 known vulnerabilities (5 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
6 · 5 medium, 1 low
Registry
npm

Advisories 6

  • CVE-2026-61612Medium 5.7

    @aborruso/ckan-mcp-server has SSRF via DNS-name → internal IP — incomplete fix of CVE-2026-53509

    Affected: fixed in 0.4.108.

  • CVE-2026-53509Medium 5.7

    @aborruso/ckan-mcp-server: SSRF via base_url allows access to internal networks (Potential fix bypass of CVE-2026-33060)

    Affected: fixed in 0.4.106.

  • CVE-2026-73846Medium 6.5

    CKAN MCP Server: Cache-key canonicalization collision enables cache confusion / poisoning

    Affected: fixed in 0.4.112.

  • CVE-2026-73845Medium 5.3

    CKAN MCP Server: MQA server allowlist bypass via unanchored regex (`isValidMqaServer`)

    Affected: fixed in 0.4.112.

  • CKAN MCP Server: Information disclosure via verbose error reflection

    Affected: fixed in 0.4.112.

  • CVE-2026-33060Medium 5.3

    CKAN MCP Server: SSRF via base_url allows access to internal networks

    Affected: fixed in 0.4.85.