CVE record published for a CKAN MCP Server SSRF filter bypass fixed in May

A CVE record for a server-side request forgery filter bypass in CKAN MCP Server reached NVD on 2026-08-21, twelve weeks after the fix shipped. The server, which queries CKAN open-data portals, is cataloged here; its current npm release (0.4.118) is well past the fixed version.

The defect is a bypass of an earlier fix. CVE-2026-33060 had established that tools accepting a base_url parameter, including ckan_package_search and sparql_query, could be pointed at arbitrary endpoints, and a filter was added to reject IP addresses. GHSA-g84h-j7jj-x32p, published 2026-05-31, shows the filter checked only the parsed hostname string: aliases like ip6-localhost and ip6-loopback, which map to ::1 in /etc/hosts on many Linux systems, are not the string localhost, not dotted IPv4, and not bracketed IPv6, so they passed the filter and resolved to loopback when the request was actually made. A remote MCP caller able to invoke the CKAN tools could reach local or private addresses and read CKAN-shaped responses back.

The fix landed in 0.4.106, published one minute before the advisory on the same May morning. NVD scores the bypass at CVSS 5.7, medium, noting it requires a valid login and user interaction. The twelve-week gap between fix and CVE record continues the pattern this week's records have shown across the ecosystem: disclosure paperwork trailing shipped fixes by weeks to months.