io.github.aborruso/ckan-mcp-server
MCP server for interacting with CKAN open data portals
Update first. Issues have been reported, but none is flagged on the version the registry lists. That version can trail the package's newest release, so check you run one past the issues below.
Registry name io.github.aborruso/ckan-mcp-server
· Source code
Reported issues
Each issue is counted once, with its other IDs listed under it. "Listed version" means the version the registry lists: "Not flagged" means OSV doesn't mark it as affected, and "Not checked" means the source gives no version we can compare.
| Issue | Severity | Listed version | Reported |
|---|---|---|---|
| GHSA-vqff-r82h-9crcckan-mcp-server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin "*" (out)Also filed as CVE-2026-76894 | low | Not flagged | Oct 16, 2026 |
| GHSA-798p-78g2-v556@aborruso/ckan-mcp-server has SSRF via DNS-name → internal IP — incomplete fix of CVE-2026-53509Also filed as CVE-2026-61612 | medium | Not flagged | Sep 21, 2026 |
| GHSA-6f9w-9hf2-5rg3CKAN MCP Server: Information disclosure via verbose error reflectionAlso filed as CVE-2026-73844 | low | Not flagged | Aug 14, 2026 |
| GHSA-83x6-42hr-jc76CKAN MCP Server: MQA server allowlist bypass via unanchored regex (`isValidMqaServer`)Also filed as CVE-2026-73845 | medium | Not flagged | Aug 14, 2026 |
| GHSA-78x9-fhhx-v2g6CKAN MCP Server: Cache-key canonicalization collision enables cache confusion / poisoningAlso filed as CVE-2026-73846 | medium | Not flagged | Aug 14, 2026 |
| GHSA-g84h-j7jj-x32p@aborruso/ckan-mcp-server: SSRF via base_url allows access to internal networks (Potential fix bypass of CVE-2026-33060)Also filed as CVE-2026-53509 | medium | Not flagged | Jul 7, 2026 |
| GHSA-3xm7-qw7j-qc8vSSRF in @aborruso/ckan-mcp-server via base_url allows access to internal networksAlso filed as CVE-2026-33060 | medium | Not flagged | Mar 18, 2026 |
Versions in the registry
0.4.139 (listed), 0.4.138, 0.4.137, 0.4.136, 0.4.135, 0.4.134, 0.4.133, 0.4.132, 0.4.131, 0.4.130, 0.4.129, 0.4.128, 0.4.127, 0.4.126, 0.4.125, 0.4.124, 0.4.123, 0.4.122, 0.4.121, 0.4.120, 0.4.119, 0.4.118, 0.4.117, 0.4.116, 0.4.115, 0.4.114, 0.4.83