CVE-2026-73846 in ckan-mcp-server
Summary
by MITRE • 08/14/2026
CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, canonicalizeParams in src/utils/cache.ts serializes request parameters with unescaped ampersand, equals-sign, and vertical-bar delimiters, allowing different logical parameter sets used by buildCacheKey to collide and an attacker to prime a shared cache with a response for a victim's distinct query. This issue is fixed in version 0.4.112.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/14/2026
The vulnerability described affects CKAN MCP Server versions prior to 04112, specifically targeting the canonicalizeParams function within the src/utils/cache.ts file. This flaw represents a cache poisoning attack vector that exploits improper parameter serialization techniques. The issue stems from the function's failure to properly escape critical delimiters including ampersand ampersands, equals signs, and vertical bars during parameter serialization processes. These unescaped characters create opportunities for logical parameter sets to produce identical cache keys despite representing different query parameters.
The technical implementation of this vulnerability allows attackers to manipulate cache entries by constructing parameter combinations that result in the same cache key as legitimate queries. When buildCacheKey processes these improperly serialized parameters, it generates identical hash values for distinct parameter sets, enabling cache collision attacks. This behavior violates fundamental cache integrity principles and creates a scenario where an attacker can inject malicious responses into shared cache systems that would normally be reserved for specific user requests.
The operational impact of this vulnerability extends beyond simple cache manipulation to potentially enable more sophisticated attacks including cross-site scripting exploitation and data injection attacks. An attacker could prime the cache with malicious responses designed to target specific users or query patterns, effectively creating a persistent attack vector that could affect multiple users simultaneously. The vulnerability particularly impacts systems that rely on shared caching mechanisms where different user requests might inadvertently share the same cache entries due to parameter collision.
This issue aligns with CWE-1247 Cache Poisoning and follows patterns identified in ATT&CK technique T1211 Command and Control Communication. The vulnerability demonstrates how improper input validation and sanitization can create persistent attack surfaces within caching infrastructure, particularly affecting systems that rely on parameter-based key generation. Organizations using CKAN MCP Server in production environments should immediately implement the patch released in version 04112 which properly escapes these delimiters during parameter serialization. Additionally, security teams should conduct thorough audits of all cache-related functions to identify similar patterns of improper parameter handling that could create comparable vulnerabilities.
The fix implemented in version 04112 addresses the root cause by ensuring proper escaping of ampersand, equals, and vertical bar characters during parameter canonicalization. This modification prevents the generation of identical cache keys for different logical parameter sets while maintaining backward compatibility with legitimate query patterns. Organizations should also consider implementing additional monitoring mechanisms to detect unusual cache behavior patterns that might indicate ongoing exploitation attempts. The vulnerability serves as a reminder of the critical importance of proper input sanitization in caching systems and demonstrates how seemingly minor oversights in parameter handling can create significant security risks within data retrieval infrastructure.