{"id":"CVE-2026-33060","aliases":["GHSA-3xm7-qw7j-qc8v"],"url":"https://o3.security/vulnerability/CVE-2026-33060","summary":"CKAN MCP Server: SSRF via base_url allows access to internal networks","details":"## Summary\n\nThe `@aborruso/ckan-mcp-server` MCP server provides tools including `ckan_package_search` and `sparql_query` that accept a `base_url` parameter, making HTTP requests to arbitrary endpoints without restriction. A CKAN portal client has no legitimate reason to contact cloud metadata or internal network services.\n\n## Severity\n\nAttack complexity is HIGH because exploitation requires prompt injection via malicious content (webpage, document) while the victim's AI assistant has this MCP server connected.\n\n## Proof of Concept\n\nTested inside Docker-in-Docker isolated environment with canary HTTP sidecar.\n\n```json\n{\"tool\": \"ckan_package_search\", \"arguments\": {\"base_url\": \"http://canary:8080/ssrf\", \"query\": \"test\"}}\n```\n**Result**: Canary received **9 HTTP requests**. The high request volume confirms no rate limiting or URL validation.\n\n## Root Cause\n\nNo URL validation on `base_url` parameter. No private IP blocking (RFC 1918, link-local 169.254.x.x), no cloud metadata blocking. The `sparql_query` and `ckan_datastore_search_sql` tools also accept arbitrary base URLs and expose injection surfaces.\n\n## Impact\n\nInternal network scanning, cloud metadata theft (IAM credentials via IMDS at 169.254.169.254), potential SQL/SPARQL injection via unsanitized query parameters. Attack requires prompt injection to control the `base_url` parameter.\n\n## Recommended Fix\n\n1. Validate `base_url` against a configurable allowlist of permitted CKAN portals\n2. Block private IP ranges (RFC 1918, link-local)\n3. Block cloud metadata endpoints (169.254.169.254)\n4. Sanitize SQL input for datastore queries\n5. SPARQL endpoint allowlist\n\n## Credit\n\nDiscovered by [Andrei Boldyrev](https://github.com/abcgco) of Munio Security Research using [munio](https://munio.dev)","published":"2026-03-20T07:21:30.897Z","modified":"2026-08-12T03:51:48.444039214Z","cvss":{"score":5.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"},"epss":{"score":0.00289,"percentile":0.21026,"asOf":"2026-09-02"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"@aborruso/ckan-mcp-server","fixedVersion":"0.4.85"}],"fix":{"url":"https://github.com/kysely-org/kysely/commit/0a602bff2f442f6c26d5e047ca8f8715179f6d24","label":"kysely-org/kysely@0a602bf"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33060.json"},{"type":"ADVISORY","url":"https://github.com/ondata/ckan-mcp-server/security/advisories/GHSA-3xm7-qw7j-qc8v"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33060"},{"type":"FIX","url":"https://github.com/kysely-org/kysely/commit/0a602bff2f442f6c26d5e047ca8f8715179f6d24"},{"type":"PACKAGE","url":"https://github.com/ondata/ckan-mcp-server"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:48.444039214Z"}}