# @aborruso/ckan-mcp-server (npm) vulnerabilities

6 known vulnerabilities (5 medium, 1 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://www.npmjs.com/package/@aborruso/ckan-mcp-server

## Advisories (6)

### [CVE-2026-61612](https://cve.now/CVE-2026-61612): @aborruso/ckan-mcp-server has SSRF via DNS-name → internal IP — incomplete fix of CVE-2026-53509

- Severity: Medium 5.7
- Published: Sep 21, 2026
- Affected: fixed in 0.4.108.

### [CVE-2026-53509](https://cve.now/CVE-2026-53509): @aborruso/ckan-mcp-server: SSRF via base\_url allows access to internal networks (Potential fix bypass of CVE-2026-33060)

- Severity: Medium 5.7
- Published: Aug 21, 2026
- Affected: fixed in 0.4.106.

### [CVE-2026-73846](https://cve.now/CVE-2026-73846): CKAN MCP Server: Cache-key canonicalization collision enables cache confusion / poisoning

- Severity: Medium 6.5
- Published: Aug 14, 2026
- Affected: fixed in 0.4.112.

### [CVE-2026-73845](https://cve.now/CVE-2026-73845): CKAN MCP Server: MQA server allowlist bypass via unanchored regex (\`isValidMqaServer\`)

- Severity: Medium 5.3
- Published: Aug 14, 2026
- Affected: fixed in 0.4.112.

### [CVE-2026-73844](https://cve.now/CVE-2026-73844): CKAN MCP Server: Information disclosure via verbose error reflection

- Severity: Low 3.7
- Published: Aug 14, 2026
- Affected: fixed in 0.4.112.

### [CVE-2026-33060](https://cve.now/CVE-2026-33060): CKAN MCP Server: SSRF via base\_url allows access to internal networks

- Severity: Medium 5.3
- Published: Mar 20, 2026
- Affected: fixed in 0.4.85.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/npm/@aborruso/ckan-mcp-server
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.