CVE-2026-73844: CKAN MCP Server: Information disclosure via verbose error reflection
CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, error paths reflect raw upstream response bodies and internal exception messages back to the caller instead of a sanitized, generic message. When the server is pointed at (or redirected/SSRF'd to) a host that returns a non-CKAN response, or when an internal exception occurs, the caller receives verbatim upstream content and internal detail (hostnames, internal IPs, DB errors, stack fragments). This vulnerability is fixed in 0.4.112.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CKAN MCP Serverto a version that resolves this vulnerability.Fixed in 0.4.112
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73844?
CVE-2026-73844 has a severity rating of low, specifically a score of 3.7.
What does CVE-2026-73844 disclose?
CVE-2026-73844 allows for information disclosure via verbose error reflection from the CKAN MCP Server.
How do I fix CVE-2026-73844?
To remediate CVE-2026-73844, update CKAN MCP Server to version 0.4.112 or later.
What type of vulnerability is CVE-2026-73844?
CVE-2026-73844 is classified under the SSRF (Server-Side Request Forgery) category.
When was CVE-2026-73844 published?
CVE-2026-73844 was published on August 14, 2026.