CVE-2026-33060
- Source
- https://cve.org/CVERecord?id=CVE-2026-33060
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33060.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-33060
- Aliases
- Published
- 2026-03-20T07:21:30.897Z
- Modified
- 2026-08-12T03:51:48.444039214Z
- Severity
-
- 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
- Summary
- CKAN MCP Server: SSRF via base_url allows access to internal networks
- Details
-
CKAN MCP Server is a tool for querying CKAN open data portals. Versions prior to 0.4.85 provide tools including ckanpackagesearch and sparqlquery that accept a baseurl parameter, making HTTP requests to arbitrary endpoints without restriction. A CKAN portal client has no legitimate reason to contact cloud metadata or internal network services. There is no URL validation on baseurl parameter. No private IP blocking (RFC 1918, link-local 169.254.x.x), no cloud metadata blocking. The sparqlquery and ckandatastoresearchsql tools also accept arbitrary base URLs and expose injection surfaces. An attack can lead to internal network scanning, cloud metadata theft (IAM credentials via IMDS at 169.254.169.254), potential SQL/SPARQL injection via unsanitized query parameters. Attack requires prompt injection to control the baseurl parameter. This issue has been fixed in version 0.4.85.
- Database specific
{ "cwe_ids": [ "CWE-918" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33060.json", "cna_assigner": "GitHub_M" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33060.json
- https://github.com/ondata/ckan-mcp-server/security/advisories/GHSA-3xm7-qw7j-qc8v
- https://nvd.nist.gov/vuln/detail/CVE-2026-33060
- https://github.com/kysely-org/kysely/commit/0a602bff2f442f6c26d5e047ca8f8715179f6d24
Affected packages
Git / github.com/kysely-org/kysely
Affected ranges
- Type
- GIT
- Repo
- https://github.com/kysely-org/kysely
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
- Database specific
-
Show details
{ "source": "REFERENCES" }
- Type
- GIT
- Repo
- https://github.com/ondata/ckan-mcp-server
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
- Database specific
-
Show details
{ "cpe": "cpe:2.3:a:ondata:ckan_mcp_server:*:*:*:*:*:node.js:*:*", "extracted_events": [ { "introduced": "0" }, { "fixed": "0.4.85" } ], "source": [ "AFFECTED_FIELD", "CPE_RANGE" ] }