CVE-2026-73846 | CyberRota

CyberRota Analysis

AI-Generated

The CKAN MCP Server prior to version 0.4.112 is vulnerable due to improper serialization of request parameters, which can lead to cache collision and allow attackers to manipulate shared cache responses. This vulnerability could enable an attacker to serve a victim a response intended for a different query, potentially exposing sensitive data. Organizations using affected versions of CKAN MCP Server should prioritize updating to the fixed version to mitigate this risk.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links

github.com ↗ github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE

CVE-2026-73846

Severity

MEDIUM

CVSS

6.5

EPSS

N/A

Original NVD Description

CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, canonicalizeParams in src/utils/cache.ts serializes request parameters with unescaped ampersand, equals-sign, and vertical-bar delimiters, allowing different logical parameter sets used by buildCacheKey to collide and an attacker to prime a shared cache with a response for a victim's distinct query. This issue is fixed in version 0.4.112.